Question 1

Which AWS service or resource provides answers to the most frequently asked security- related questions that AWS receives from its users'?

Accepted Answer

AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’s security and
compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card
Industry (PCI) attestation of compliance, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation
and operating effectiveness of AWS security controls. Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the
Nondisclosure Agreement (NDA). AWS Artifact helps you answer the most frequently asked security and compliance questions that AWS receives from its users.
References: Compliance FAQ, Compliance Solutions Guide

Question 2

A company wants to monitor for misconfigured security groups that are allowing unrestricted access to specific ports.
Which AWS service will meet this requirement?

Accepted Answer

AWS Trusted Advisor is an online tool that provides you real time guidance to help you provision your resources following AWS best practices, including security
and performance. It can help you monitor for misconfigured security groups that are allowing unrestricted access to specific ports. Amazon CloudWatch is a
service that monitors your AWS resources and the applications you run on AWS. Amazon GuardDuty is a threat detection service that continuously monitors for
malicious activity and unauthorized behavior. AWS Health Dashboard provides relevant and timely information to help you manage events in progress, and
provides proactive notification to help you plan for scheduled activities.

Question 3

Which abilities are benefits of the AWS Cloud? (Select TWO.)

Accepted Answer

The AWS Cloud offers many benefits, such as:
? Trade variable expenses for capital expenses: You can pay only for the resources you use, instead of investing in fixed costs upfront. This reduces the risk and
complexity of planning and managing your IT infrastructure4
? Deploy globally in minutes: You can leverage the global infrastructure of AWS to deploy your applications and data in multiple regions and availability zones. This
enables you to reach your customers faster, improve performance, and increase reliability5

Question 4

A company wants durable storage for static content and infinitely scalable data storage infrastructure at the lowest cost.
Which AWS service should the company choose?

Accepted Answer

Amazon S3 is a service that provides durable storage for static content and infinitely scalable data storage infrastructure at the lowest cost. Amazon S3 is an
object storage service that allows you to store and retrieve any amount of data from anywhere on the internet. Amazon S3 offers industry-leading scalability,
availability, and performance, as well as 99.999999999% (11 9s) of durability and multi-AZ resilience. Amazon S3 also provides various storage classes that offer
different levels of performance and cost optimization, such as S3 Standard, S3 Intelligent-Tiering, S3 Standard-Infrequent Access (S3 Standard-IA), S3 One ZoneInfrequent Access (S3 One Zone-IA), and S3 Glacier456. Amazon S3 is ideal for storing static content, such as images, videos, documents, and web pages, as
well as building data lakes, backup and archive solutions, big data analytics, and machine learning applications456. References: 4: Cloud Storage on AWS, 5:
Object Storage - Amazon Simple Storage Service (S3) - AWS, 6: Amazon S3 Documentation

/CLF-C01-exam/ (370 Q&As)

Question 5

Which AWS service is a cloud security posture management (CSPM) service that aggregates alerts from various AWS services and partner products in a
standardized format?

Accepted Answer

AWS Security Hub is a cloud security posture management (CSPM) service that performs security best practice checks, aggregates alerts, and enables
automated remediation. Security Hub collects findings from the security services enabled across your AWS accounts, such as intrusion detection findings from
Amazon GuardDuty, vulnerability scans from Amazon Inspector, and sensitive data identification findings from Amazon Macie. Security Hub also collects findings
from partner security products using a standardized AWS Security Finding Format, eliminating the need for time-consuming data parsing and normalization efforts.
Customers can designate an administrator account that can access all findings across their accounts. References: AWS Security Hub Overview, AWS Security
Hub FAQs

Question 6

What is the LEAST expensive AWS Support plan that provides the full set of AWS Trusted Advisor best practice checks for cost optimization?

Accepted Answer

AWS Business Support is the least expensive AWS Support plan that provides the full set of AWS Trusted Advisor best practice checks for cost optimization.
AWS Trusted Advisor is a service that provides best practices and recommendations for cost optimization, performance, security, and fault tolerance. AWS
Business Support also provides other benefits, such as 24/7 technical support, unlimited cases, and faster response times. AWS Enterprise Support is the most
expensive AWS Support plan that provides the same benefits as AWS Business Support, plus additional benefits, such as a technical account manager and
enterprise concierge support. AWS Developer Support and AWS Basic Support are cheaper AWS Support plans that provide only a limited set of AWS Trusted
Advisor best practice checks for cost optimization .

Question 7

Which of the following services can be used to block network traffic to an instance? (Select TWO.)

Accepted Answer

Security groups and network ACLs are two AWS services that can be used to block network traffic to an instance. Security groups are virtual firewalls that control
the inbound and outbound traffic for your instances at the instance level. You can specify which protocols, ports, and source or destination IP addresses are
allowed or denied for each instance. Security groups are stateful, which means that they automatically allow return traffic for any allowed inbound or outbound
traffic123. Network ACLs are virtual firewalls that control the inbound and outbound traffic for your subnets at the subnet level. You can create rules to allow or
deny traffic based on protocols, ports, and source or destination IP addresses. Network ACLs are stateless, which means that you have to explicitly allow return
traffic for any allowed inbound or outbound traffic456. References: 1: Security groups for your VPC - Amazon Virtual Private Cloud, 2: Security Groups for Your
VPC - Amazon Elastic Compute Cloud, 3: AWS Security Groups: Everything You Need to
Know, 4: Network ACLs - Amazon Virtual Private Cloud, 5: Control traffic to subnets using network ACLs - Amazon Virtual Private Cloud, 6: AWS Network ACLs:
Everything You
Need to Know

Question 8

A company uses AWS Organizations. The company wants to apply security best practices from the AWS Well-Architected Framework to all of its AWS accounts.
Which AWS service will meet these requirements?

Accepted Answer

AWS Control Tower is the easiest way to set up and govern a secure, multi- account AWS environment based on best practices established through AWS’s
experience working with thousands of enterprises as they move to the cloud. With AWS Control Tower, builders can provision new AWS accounts in a few clicks,
while you have peace of mind knowing your accounts conform to your organization’s policies. AWS Control Tower automates the setup of a baseline environment,
or landing zone, that is a secure, well- architected multi-account AWS environment1. AWS Control Tower helps you apply security best practices from the AWS

/CLF-C01-exam/ (370 Q&As)
Well-Architected Framework to all of your AWS accounts2.

Question 9

A company that has multiple business units wants to centrally manage and govern its AWS Cloud environments. The company wants to automate the creation of
AWS accounts, apply service control policies (SCPs), and simplify billing processes.
Which AWS service or tool should the company use to meet these requirements?

Accepted Answer

AWS Organizations is an AWS service that enables you to centrally manage and govern your AWS Cloud environments across multiple business units. AWS
Organizations allows you to create an organization that consists of AWS accounts that you create or invite to join. You can group your accounts into organizational
units (OUs) and apply service control policies (SCPs) to them. SCPs are a type of policy that specify the maximum permissions for the accounts in your
organization, and can help you enforce compliance and security requirements. AWS Organizations also simplifies billing processes by enabling you to consolidate
and pay for all member accounts with a single payment method. You can also use AWS Organizations to automate the creation of AWS accounts by using APIs or
AWS CloudFormation templates. References: What is AWS Organizations?, Policy-Based Management - AWS Organizations

Question 10

A company needs to engage third-party consultants to help maintain and support its AWS environment and the company's business needs.
Which AWS service or resource will meet these requirements?

Accepted Answer

The AWS service or resource that will meet these requirements is D. AWS Partner Network (APN).
AWS Partner Network (APN) is a global community of consulting and technology partners that offer a wide range of services and solutions for AWS customers.
APN partners can help customers design, architect, build, migrate, and manage their workloads and applications on AWS. APN partners have access to various
resources, training, tools, and support to enhance their AWS expertise and deliver value to customers12.
AWS Support is a service that provides technical assistance and guidance for AWS customers. AWS Support offers different plans with varying levels of response
time, access channels, and features. AWS Support does not directly engage third-party consultants, but rather connects customers with AWS experts and
resources3.
AWS Organizations is a service that allows customers to manage multiple AWS accounts within a single organization. AWS Organizations enables customers to
create groups of accounts, apply policies, automate account creation, and consolidate billing. AWS Organizations does not directly engage third-party consultants,
but rather helps customers simplify and optimize their AWS account management4.
AWS Service Catalog is a service that allows customers to create and manage catalogs of IT services that are approved for use on AWS. AWS Service Catalog
enables customers to control the configuration, deployment, and governance of their IT services. AWS Service Catalog does not directly engage third-party
consultants, but rather helps customers standardize and streamline their IT service delivery5.
References:
1: AWS Partner Network (APN) - Amazon Web Services (AWS) 2: Find an APN Partner - Amazon Web Services (AWS) 3: AWS Support – Amazon Web Services
4: AWS Organizations – Amazon Web Services 5: AWS Service Catalog – Amazon Web Services