Amazon AWS Certified Foundational CLF-C01 Questions & Answers

• Question 501:

  A company has set up a VPC in its AWS account and has created a subnet in the VPC. The company wants to make the subnet public. Which AWS features should the company use to meet this requirement? (Choose two.)

  A. Amazon VPC internet gateway

  B. Amazon VPC NAT gateway

  C. Amazon VPC route tables

  D. Amazon VPC network ACL

  E. Amazon EC2 security groups

  Correct Answer: AC

  To make a subnet public in AWS, the following two features should be used:

  A. Amazon VPC internet gateway: An internet gateway is used to enable communication between instances in the VPC and the internet. By attaching an internet gateway to a VPC and updating the route tables, instances in the subnet can access the internet.

  C. Amazon VPC route tables: A route table controls the traffic between subnets and between a subnet and the internet. By adding a route to the internet gateway, the instances in the subnet can access the internet. Therefore, options A and C are correct.

• Question 502:

  A company needs to centralize its operational data. The company also needs to automate tasks across all of its Amazon EC2 instances. Which AWS service can the company use to meet these requirements?

  A. AWS Trusted Advisor

  B. AWS Systems Manager

  C. AWS CodeDeploy

  D. AWS Elastic Beanstalk

  Correct Answer: B

  The AWS service that the company can use to centralize its operational data and automate tasks across all of its Amazon EC2 instances is AWS Systems Manager. Option B is the correct answer.

  AWS Systems Manager is a management service that helps you automatically collect software inventory, apply OS patches, create system images, and configure operating systems and applications at scale. It provides a unified user interface that allows you to view operational data from multiple AWS services and automate operational tasks across all of your EC2 instances, on-premises servers, and virtual machines.

• Question 503:

  What is the total volume of data that can be stored in Amazon S3?

  A. 10 PB

  B. 50 PB

  C. 100 PB

  D. Virtually unlimited

  Correct Answer: D

• Question 504:

  A company provides a software as a service (SaaS) application. The company has a new customer that is based in a different country. The new customer's data needs to be hosted in that country. Which AWS service or infrastructure component should the company use to meet this requirement?

  A. AWS Shield

  B. Amazon S3 Object Lock

  C. AWS Regions

  D. Placement groups

  Correct Answer: C

  To meet the requirement of hosting data in a specific country, the company should use an AWS region that is located in that country. AWS Regions are geographic locations where AWS provides services. Each region consists of multiple availability zones that are physically separated from each other within a region to provide fault tolerance and scalability. By selecting the appropriate region, the company can ensure that the new customer's data is hosted in the desired country.

• Question 505:

  A company is using Amazon EC2 instances.

  Which tasks are the company's responsibility, according to the AWS shared responsibility model? (Select TWO.)

  A. Choose the initial root password of new Linux instances.

  B. Identify which users can access the EC2 instances, and manage their permissions in the operating system.

  C. Apply the updates of the hypervisor where the EC2 instances are running.

  D. Choose between a Wi-Fi connection and an Ethernet connection for the global internet access.

  E. Identify and manage the users who are allowed to create or delete EC2 instances.

  Correct Answer: BE

• Question 506:

  A company has migrated its workload to AWS. The company wants to forecast the workload's costs for each quarter for the next year. Which AWS service or tool provides this functionality?

  A. AWS Organizations

  B. AWS Budgets

  C. AWS Cost Explorer

  D. AWS Cost and Usage Report

  Correct Answer: C

• Question 507:

  A company needs to use Amazon S3 to store audio files that are each 5 megabytes in size. The company will rarely access the files, but the company must be able to retrieve the files immediately. Which S3 storage class will meet these requirements MOST cost-effectively?

  A. S3 Standard

  B. S3 Standard-Infrequent Access (S3 Standard-AI)

  C. S3 Glacier Flexible Retrieval

  D. S3 Glacier Deep Archive

  Correct Answer: B

• Question 508:

  A company needs an AWS design solution for a distributed system. The system's components need to be set up so that one system component cannot negatively impact another component. Which AWS architectural best practice will meet this requirement?

  A. Use request throttling

  B. Use a stateful service

  C. Implement automatic data backups

  D. Implement loose coupling

  Correct Answer: D

  D. Implement loose coupling

  Implementing loose coupling is an architectural best practice that helps to prevent one system component from negatively impacting another component. Loose coupling is achieved by designing the system so that each component is independent of the others and only communicates with them through a well-defined interface. This allows changes to be made to one component without affecting the others, and also allows the system to be more resilient to failures. When components are loosely coupled, it's easier to scale, maintain, and update the system, as well as to troubleshoot issues.

  Use request throttling is a technique to control the rate of incoming requests to a service, avoiding overloading it, but it does not prevent one component from impacting another.

  A stateful service is one that maintains state information across requests, which could cause issues if not properly managed. Implementing automatic data backups is a security best practice, but it doesn't prevent one component from impacting another.

• Question 509:

  Which AWS service is a cloud security posture management (CSPM) service that aggregates alerts from various AWS services and partner products in a standardized format?

  A. AWS Security Hub

  B. AWS Trusted Advisor

  C. Amazon EventBridge

  D. Amazon GuardDuty

  Correct Answer: A

  Explanation: Use AWS Security Hub to automate security best practice checks, aggregate security alerts into a single place and format, and understand your overall security posture across all of your AWS accounts.

• Question 510:

  A company provides Amazon Workspaces to its remote employees. The company wants to prevent employees from using their virtual desktops to visit specific websites that are known to be malicious. Which AWS service should the company use to meet this requirement?

  A. AWS Shield Advanced

  B. Amazon Route 53

  C. Amazon GuardDuty

  D. AWS Network Firewall

  Correct Answer: D

  Explanation: https://aws.amazon.com/blogs/desktop-and-application-streaming/filtering- internet-traffic- from-amazon-workspaces/

  AWS Network Firewall extends protection beyond SG- and NACL-levels by protecting at the route level and offering stateless and stateful rules from layers 3 through 7 in the OSI Model. It uses the certificate fully qualified domain name (FQDN) or Server Name Indication (SNI) to determine if a website is allowed for HTTPS traffic. This is a commonly requested security requirement. Reviewing these design examples of AWS Network Firewall will accelerate your migration to Amazon WorkSpaces. AWS Network Firewall is a managed service, with no infrastructure to manage or patch you can simplify operational excellence. Native settings for advanced filtering (including domain name), and network traffic inspection can alert and block traffic related to malware. It also has layer 7 intrusion prevent system (IPS) rules, and the ability to apply TLS fingerprinting to prevent a spoofed IP or FQDN.