Amazon CLF-C01 Online Practice Questions and Exam Preparation

Amazon CLF-C01 Online Questions & Answers

• Question 621:

  A company wants to implement controls (guardrails) in a newly created AWS Control Tower landing zone.

  Which AWS services or features can the company use to create and define these controls (guardrails)? (Choose two.)

  A. AWS config
  B. Service control policies (SCPs)
  C. Amazon Guard Duly
  D. AWS Identity and Access Management (1AM)
  E. Security groups
  B. Service control policies (SCPs)
  D. AWS Identity and Access Management (1AM)

  ---

  Explanation/Reference:

  When creating a new AWS Control Tower landing zone, you can define policies to enforce permissions boundaries and ensure compliance across your AWS environment. AWS provides several services and features to help create and define these policies, and two of the primary tools are Service Control Policies (SCPs) and AWS Identity and Access Management (IAM) policies.

  Service Control Policies (SCPs) are used to define permission guardrails across accounts in a Control Tower landing zone. With SCPs, you can limit permissions for IAM entities (users, groups, and roles) and the resources they can access. SCPs work as a whitelist, explicitly allowing access to only the specified resources and services, and denying access to all other resources and services. This helps to enforce compliance policies across all accounts and resources within the AWS Control Tower environment.

• Question 622:

  Which of the following describes an AWS Region?

  A. specific location within a geographic area that provides high availability
  B. Set of data centers spanning multiple countries
  C. A global picture of a user's cloud computing environment
  D. A collection of databases that can be accessed from a specific geographic area only
  A. specific location within a geographic area that provides high availability

• Question 623:

  A company notices suspicious network activity against an application that is running on a fleet of Amazon EC2 instances The suspicious activity is coming from a single IP address Which AWS service should the company use to block access from this IP address?

  A. AWS Shield
  B. AWS Config
  C. Amazon GuardDuty
  D. AWS WAF
  D. AWS WAF

  ---

  Explanation/Reference:

  AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to your protected web application resources. You can protect the following resource types:

  1.

  Amazon CloudFront distribution

  2.

  Amazon API Gateway REST API

  3.

  Application Load Balancer

  4.

  AWS AppSync GraphQL API

  5.

  Amazon Cognito user pool

  6.

  AWS WAF also lets you control access to your content.

  Based on conditions that you specify, such as the IP addresses that requests originate from or the values of query strings, your protected resource responds to requests either with the requested content, with an HTTP 403 status code (Forbidden), or with a custom response. https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html

• Question 624:

  Which AWS service provides a relational database management system that is fully compatible with MySQL and PostgreSQL?

  A. Amazon DynamoDB
  B. Amazon Aurora
  C. Amazon Neptune
  D. Amazon Athena
  B. Amazon Aurora

• Question 625:

  Which AWS service should be used when a company needs to provide its remote employees with virtual desktops?

  A. Amazon Identity and Access Management (IAM)
  B. AWS Directory Service
  C. AWS IAM Identity Center (AWS Single Sign-On)
  D. Amazon Workspaces
  D. Amazon Workspaces

• Question 626:

  How can an AWS user conduct security assessments of Amazon EC2 instances, NAT gateways, and Elastic Load Balancers in a way that is approved by AWS?

  A. Flood a target with requests.
  B. Use Amazon Inspector.
  C. Perform penetration testing.
  D. Use the AWS Service Health Dashboard.
  C. Perform penetration testing.

  ---

  Explanation/Reference:

  C. Perform penetration testing.

  AWS provides customers with the ability to conduct security assessments of Amazon EC2 instances, NAT gateways, and Elastic Load Balancers through penetration testing. Penetration testing, also known as "pen testing" is a simulated cyber attack against your own systems, in order to evaluate the security of your infrastructure. This can be done using approved tools and methodologies, such as those provided by the AWS Penetration Testing Program.

• Question 627:

  Which AWS service allows for file sharing between multiple Amazon EC2 instances?

  A. AWS Direct Connect
  B. AWS Snowball Edge
  C. AWS Backup
  D. Amazon Elastic File System (Amazon EFS)
  D. Amazon Elastic File System (Amazon EFS)

  ---

  Explanation/Reference:

  Amazon EFS provides shared file storage for use with compute instances in the AWS Cloud and on-premises servers. Applications that require shared file access can use Amazon EFS for reliable file storage delivering high aggregate throughput to thousands of clients simultaneously.

• Question 628:

  A system automatically recovers from failure when a company launches its workload on the AWS Cloud services platform. Which pillar of the AWS Well-Architected Framework does this situation demonstrate?

  A. Reliability
  B. Cost optimization
  C. Performance efficiency
  D. Operational excellence.
  D. Operational excellence.

  ---

  Explanation/Reference:

  https://aws.amazon.com/blogs/apn/the-6-pillars-of-the-aws-well-architected- framework/

  Built around six pillars--operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability--AWS Well-Architected provides a consistent approach for customers and partners to evaluate architectures and

  implement scalable designs.

  Reliability

  The Reliability pillar encompasses the ability of a workload to perform its intended function correctly and consistently when it's expected to. This includes the ability to operate and test the workload through its total lifecycle. You can find

  prescriptive guidance on implementation in the Reliability Pillar whitepaper.

• Question 629:

  A company is launching a mobile app. The company wants customers to be able to use the app without upgrading their mobile devices.

  Which pillar of the AWS Well-Architected Framework does this goal represent?

  A. Security
  B. Reliability
  C. Cost optimization
  D. Sustainability
  A. Security

• Question 630:

  A company hosts an application on multiple Amazon EC2 instances. The application uses Amazon Simple Notification Service (Amazon SNS) to send messages.

  Which AWS service or feature will give the application permission to access required AWS services?

  A. AWS Certificate Manager (ACM)
  B. IAM roles
  C. AWS Security Hub
  D. Amazon GuardDuty
  B. IAM roles