Amazon CLF-C01 Online Practice Questions and Exam Preparation

Amazon CLF-C01 Online Questions & Answers

• Question 681:

  What can a cloud practitioner use to retrieve AWS security and compliance documents and submit them as evidence to an auditor or regulator?

  A. AWS Certificate Manager
  B. AWS Systems Manager
  C. AWS Artifact
  D. Amazon Inspector
  B. AWS Systems Manager

• Question 682:

  Which Amazon VPC feature enables users to capture information about the IP traffic that reaches Amazon EC2 instances?

  A. Security groups
  B. Elastic network interfaces
  C. Network ACLs
  D. VPC Flow Logs
  D. VPC Flow Logs

  ---

  Explanation/Reference:

  VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs or Amazon S3. After you've created a flow log, you can retrieve and view its data in the chosen destination.

  Reference: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

• Question 683:

  Which of the following are advantages of the AWS Cloud? (Select TWO.)

  A. AWS management of user-owned infrastructure
  B. Ability to quickly change required capacity
  C. High economies of scale
  D. Increased deployment time to market
  E. Increased fixed expenses
  B. Ability to quickly change required capacity
  C. High economies of scale

  ---

  Explanation/Reference:

  In the 6 advantages of Cloud :

  C. Economy at scale: You profit of massive aggregation of resources consumed by all customers on the AWS platform

  B. Rapidity and Agility.

• Question 684:

  A company is using on-premises Microsoft Active Directory federation to manage user identities and groups.

  What AWS Identity and Access Management (IAM) setting maps the permissions for AWS services to the Active Directory user attributes?

  A. IAM users
  B. IAM access keys
  C. IAM roles
  D. IAM groups
  C. IAM roles

  ---

  Explanation/Reference:

  How to Connect Your On-Premises Active Directory to AWS Using AD Connector Assign users to roles

  Now that AD Connector is configured and you've created a role, your next job is to assign users or groups to those IAM roles. Role mapping is what governs what resources a user has access to within AWS. To do this you'll need to:

  Open the Directory Service console, and click the link to Manage Access.Image of Manage Access link

  Click Create New Role.Image of Create New Role button Click Use Existing Role. Note: If you've already assigned Active Directory users or groups to a role, you will be able to modify their membership by clicking the link for the role in the

  Directory Service console.Select a role Select a role from the list, and then click Next Step.Image of selecting a role from the list Type the name of an Active Directory user or group in the search field.

  Click Next Step.

  Click Create Role Assignments.

  

  Image of reviewing user or group with corresponding Id When you're finished you should see the name of the user or group along with the corresponding Id for that object, as shown in the previous image. The next time the user signs in to the AWS Management Console from the custom sign-in page, they will be signed in under the EC2ReadOnly security role.

  

  Image of EC2ReadOnly security role

  Seamlessly join an instance to an Active Directory domain Another advantage to using AD Connector is the ability to seamlessly join Windows (EC2) instances to your Active Directory domain. You may have read about this feature in the

  AWS Blog earlier this year. It's what allows you to join a Windows Server to the domain while the instance is being provisioned instead of using a script or doing it manually. This section of this blog post will explain the steps necessary to

  enable this feature in your environment and how the service works.

  Step 1: Create a role

  Until recently you had to manually create an IAM policy to allow an EC2 instance to access the SSM, an AWS service that allows you to configure Windows instances while they're running and on first launch. Now, there's a managed policy

  called AmazonEC2RoleforSSM that you can use instead. The role you are about to create will be assigned to an EC2 instance when it's provisioned, which will grant it permission to access the SSM service.

  To create the role:

  Open the IAM console.

  Click Roles in the navigation pane.

  Click Create Role.

  Type a name for your role in the Role Name field. Under AWS Service Roles, select Amazon EC2 and then click Select. On the Attach Policy page, select AmazonEC2RoleforSSM and then click Next Step.

  On the Review page, click Create Role.

• Question 685:

  What is a feature of Amazon Route 53?

  A. Routing users to infrastructure both Inside and outside AWS
  B. Providing a private connection to infrastructure inside AWS
  C. Providing a private connection to Infrastructure outside AWS
  D. Distributing content across edge locations
  C. Providing a private connection to Infrastructure outside AWS

• Question 686:

  A company has a large number of Linux Amazon EC2 instances across several Availability Zones in an AWS Region. Applications that run on the EC2 instances need access to a common set of files.

  Which AWS service or device should the company use to meet this requirement?

  A. AWS Backup
  B. Amazon Elastic File System (Amazon EFS)
  C. Amazon Elastic Block Store (Amazon EBS)
  D. AWS Snowball Edge Storage Optimized
  B. Amazon Elastic File System (Amazon EFS)

• Question 687:

  A company needs an Amazon S3 bucket that cannot have any public objects due to compliance requirements. How can this be accomplished?

  A. Enable S3 Block Public Access from the AWS Management Console.
  B. Hold a team meeting to discuss the importance if only uploading private S3 objects.
  C. Require all S3 objects to be manually approved before uploading.
  D. Create a service to monitor all S3 uploads and remove any public uploads.
  A. Enable S3 Block Public Access from the AWS Management Console.

  ---

  Explanation/Reference:

  Reference: https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html

• Question 688:

  What is a responsibility of AWS in the shared responsibility model?

  A. Updating the network ACLs to block traffic to vulnerable ports.
  B. Patching operating systems running on Amazon EC2 instances.
  C. Updating the firmware on the underlying EC2 hosts.
  D. Updating the security group rules to block traffic to the vulnerable ports.
  C. Updating the firmware on the underlying EC2 hosts.

  ---

  Explanation/Reference:

  Reference: https://cloudacademy.com/blog/aws-shared-responsibility-model-security/

• Question 689:

  A company needs to store database backups. The company must be able to retrieve the data in minutes Backup restorations will take place once a year. Which AWS solution should the company use to meet these requirements at the LOWEST cost?

  A. Amazon Elastic Block Store (Amazon EBS)
  B. Amazon S3 Glacier
  C. Amazon Elastic File System (Amazon EFS)
  D. Amazon S3 Standard
  B. Amazon S3 Glacier

• Question 690:

  A company is using Amazon DynamoDB.

  Which task is the company's responsibility, according to the AWS shared responsibility model?

  A. Patch the operating system.
  B. Provision hosts.
  C. Manage database access permissions.
  D. Secure the operating system.
  C. Manage database access permissions.

  ---

  Explanation/Reference:

  Which tasks is the companies, which means the customer.

  It is a serverless database nosql. Which we just manage it as a SaaS, therefor just permissions, nothing of provisioning.