Amazon Amazon Certifications CLF-C01 Questions & Answers

• Question 31:

  Which AWS service can be used to encrypt data at rest?

  A. Amazon GuardDuty

  B. AWS Shield

  C. AWS Security Hub

  D. AWS Key Management Service (AWS KMS)

  Correct Answer: D

  Reference: https://aws.amazon.com/blogs/security/how-to-protect-data-at-rest-with-amazon-ec2-instance-store-encryption/

• Question 32:

  Which characteristics are advantages of using the AWS Cloud? (Choose two.)

  A. A 100% service level agreement (SLA) for all AWS services

  B. Compute capacity that is adjusted on demand

  C. Availability of AWS Support for code development

  D. Enhanced security

  E. Increases in cost and complexity

  Correct Answer: BD

• Question 33:

  A user is storing objects in Amazon S3. The user needs to restrict access to the objects to meet compliance obligations. What should the user do to meet this requirement?

  A. Use AWS Secrets Manager.

  B. Tag the objects in the S3 bucket.

  C. Use security groups.

  D. Use network ACLs.

  Correct Answer: B

  Secrets Manager is for secrets (passwords)

  Network ACL is a statekless firewall working on IPs, not users. Security Groups are stateful firewall, not for user permissions.

  In this case I'd say tags:

  https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html "Object tags enable fine-grained access control of permissions. For example, you could grant an IAM user permissions to read-only objects with specific tags."

• Question 34:

  A retail company needs to build a highly available architecture for a new ecommerce platform. The company is using only AWS services that replicate data across multiple Availability Zones.

  Which AWS services should the company use to meet this requirement? (Select TWO.)

  A. Amazon EC2

  B. Amazon Elastic Block Store (Amazon EBS)

  C. Amazon Aurora

  D. Amazon DynamoDB

  E. Amazon Redshift

  Correct Answer: CD

  Reference: https://aws.amazon.com/rds/features/multi-az/#:~:text=Amazon%20Aurora%20further%20extends%20the,ways%2C%20across%20three%20Availability%20Zones

• Question 35:

  A company has a fleet of cargo ships. The cargo ships have sensors that collect data at sea, where there is intermittent or no internet connectivity. The company needs to collect, format, and process the data at sea and move the data to AWS

  later.

  Which AWS service should the company use to meet these requirements?

  A. AWS IoT Core

  B. Amazon Lightsail

  C. AWS Storage Gateway

  D. AWS Snowball Edge

  Correct Answer: D

  AWS Snow Family- The AWS Snow Family is a collection of physical devices that help migrate large amounts of data into and out of the cloud without depending on networks. This helps you apply the wide variety of AWS services for analytics, file systems, and archives to your data. You can use AWS Snow Family services for data transfer and occasional pre-processing on location. Some large data transfer examples include cloud migration, disaster recovery, data center relocation, and/or remote data collection projects. These projects typically require you to migrate large amounts of data in the shortest, and most cost-effective, amount of time.

• Question 36:

  Which AWS service or feature checks access policies and offers actionable recommendations to help users set secure and functional policies?

  A. AWS Systems Manager

  B. AWS IAM Access Analyzer

  C. AWS Trusted Advisor

  D. Amazon GuardDuty

  Correct Answer: B

  AWS Systems Manager is a management service that helps you automatically collect software inventory, apply OS patches, create system images, and configure Windows and Linux operating systems. You can use Systems Manager to

  manage hybrid environments that include resources in your on-premises data centers and in the AWS Cloud.

  AWS IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. IAM Access Analyzer validates IAM policies against policy grammar and best practices. IAM Access Analyzer

  generates IAM policies based on access activity in your AWS CloudTrail logs.

  AWS Trusted Advisor provides recommendations to help you follow AWS best practices for security, cost optimization, performance improvement, and fault tolerance. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.

• Question 37:

  A company needs to install an application in a Docker container. Which AWS service eliminates the need to provision and manage the container hosts?

  A. AWS Fargate

  B. Amazon FSx for Windows File Server

  C. Amazon Elastic Container Service (Amazon ECS)

  D. Amazon EC2

  Correct Answer: A

  https://aws.amazon.com/ecs/

  Optimize your time with AWS Fargate serverless compute for containers, which eliminates the need to configure and manage control plane, nodes, and instances.

  https://aws.amazon.com/fargate/

  Deploy and manage your applications, not infrastructure. Fargate removes the operational overhead of scaling, patching, securing, and managing servers.

• Question 38:

  Which AWS service uses edge locations?

  A. Amazon Aurora

  B. AWS Global Accelerator

  C. Amazon Connect

  D. AWS Outposts

  Correct Answer: B

  Reference: https://aws.amazon.com/global-accelerator/

• Question 39:

  A company wants to implement threat detection on its AWS infrastructure. However, the company does not want to deploy additional software. Which AWS service should the company use to meet these requirements?

  A. Amazon VPC

  B. Amazon EC2

  C. Amazon GuardDuty

  D. AWS Direct Connect

  Correct Answer: C

  from: https://aws.amazon.com/guardduty/

  1.

  Continuously monitor your AWS accounts, instances, container workloads, users, and storage for potential threats.

  2.

  Expose threats quickly using anomaly detection, machine learning, behavioral modeling, and threat intelligence feeds from AWS and leading third-parties.

  3.

  Mitigate threats early by initiating automated responses.

• Question 40:

  A company wants to use the AWS Cloud to provide secure access to desktop applications that are running in a fully managed environment. Which AWS service should the company use to meet this requirement?

  A. Amazon S3

  B. Amazon AppStream 2.0

  C. AWS AppSync

  D. AWS Outposts

  Correct Answer: B

  AWS Outposts is the service that meets the company's requirement of migrating the workload to AWS while minimizing latency and maintaining the performance of the application. AWS Outposts is a fully managed service that allows you to run AWS infrastructure and services on-premises, in your own data center, or at the edge of your network. It is designed to be used in environments where low-latency, high- throughput, or high-bandwidth applications are critical, and where internet connectivity is limited or unreliable.