CLF-C02 practice questions 201–210

1. Question 201 · 712 in bank

   A global company wants to use a managed security service for protection from SQL injection attacks. The service also must provide detailed logging information about access to the company's ecommerce applications. Which AWS service will meet these requirements?

   • AAWS Network Firewall
   • BAmazon RDS for SQL Server
   • CAmazon GuardDuty
   • DAWS WAF

   Show answer

   Answer: D

   Explanation

   AWS WAF (Web Application Firewall) is a web application firewall service that helps protect web applications from common web exploits and attacks, including SQL injection attacks. It allows you to define custom rules and conditions to filter and control inbound web traffic, providing protection against SQL injection attacks. Additionally, AWS WAF provides detailed logging information about access to your web applications, including information about requests, IP addresses, and response codes. https://pupuweb.com/answer-explained-which-aws-managed-security-service-protect-sql-injection-attacks-access-logging-ecommerce-app/

   Source: Adapted from community discussion — BShelat

   References

   • AWS documentation

   Next question

2. Question 202 · 712 in bank

   A company is migrating its on-premises server to an Amazon EC2 instance. The server must stay active at all times for the next 12 months. Which EC2 pricing option is the MOST cost-effective for the company's workload?

   • AOn-Demand
   • BDedicated Hosts
   • CSpot Instances
   • DReserved Instances

   Show answer

   Answer: D

   Next question

3. Question 203 · 712 in bank

   Select 2

   Which of the following is the customer's responsibility under the AWS shared responsibility model? (Choose two.)

   • AMaintain the configuration of infrastructure devices.
   • BMaintain patching and updates within the hardware infrastructure.
   • CMaintain the configuration of guest operating systems and applications.
   • DManage decisions involving encryption options.
   • EMaintain infrastructure hardware.

   Show answer

   Answer: CD

   Explanation

   Explanation: C. Customers are responsible for maintaining the configuration, security, and updates of the guest operating systems and any applications running on their Amazon EC2 instances or other AWS resources. This includes tasks such as applying security patches and updates to the operating systems and applications. D. Customers are responsible for managing decisions related to encryption options for their data. This includes deciding whether to encrypt data at rest, in transit, and managing encryption keys and policies for their AWS resources.

   Source: Adapted from community discussion — Sandy1254

   References

   • AWS documentation

   Next question

4. Question 204 · 712 in bank

   A company wants to verify if multi-factor authentication (MFA) is enabled for all users within its AWS accounts. Which AWS service or resource will meet this requirement?

   • AAWS Cost and Usage Report
   • BIAM credential reports
   • CAWS Artifact
   • DAmazon CloudFront reports

   Show answer

   Answer: B

   Explanation

   https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html IAM credential reports are delivered in CSV format. "mfa_active" is one of many columns of this report. When a MFA device is enabled for the user, value of this column is TRUE.

   Source: Adapted from community discussion — BShelat

   References

   • AWS documentation

   Next question

5. Question 205 · 712 in bank

   A company uses AWS security services and tools. The company needs a service to help manage the security alerts and must organize the alerts into a single dashboard. Which AWS service should the company use to meet these requirements?

   • AAmazon GuardDuty
   • BAmazon Inspector
   • CAmazon Macie
   • DAWS Security Hub

   Show answer

   Answer: D

   Explanation

   D. AWS Security Hub AWS Security Hub is a comprehensive security service that provides a centralized view of security alerts and compliance status across multiple AWS accounts. It aggregates findings from various AWS security services, including Amazon GuardDuty, Amazon Inspector, and Amazon Macie, as well as integrated third-party security solutions. Security Hub consolidates these findings into a single dashboard, making it easier for organizations to monitor and manage their overall security posture.

   Source: Adapted from community discussion — chalaka

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 206 · 712 in bank

   A company wants to run its workloads in the AWS Cloud effectively, reduce management overhead, and improve processes. Which AWS Well-Architected Framework pillar represents these requirements?

   • AReliability
   • BOperational excellence
   • CPerformance efficiency
   • DCost optimization

   Show answer

   Answer: B

   Explanation

   B. Keyphrase for operational excellence: Run and monitor systems to deliver business value and to "improve supporting processes and procedures".

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 207 · 712 in bank

   A company uses Amazon S3 to store records that can contain personally identifiable information (PII). The company wants a solution that can monitor all S3 buckets for PII and immediately alert staff about vulnerabilities. Which AWS service will meet these requirements?

   • AAmazon GuardDuty
   • BAmazon Detective
   • CAmazon Macie
   • DAWS Shield

   Show answer

   Answer: C

   Explanation

   PII = Sensitive Data. Amazon Macie identifies Sensitive Data. https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html Important Note: I am noticing that there are incorrect answers for may questions in this question set. I would request administrator of this question set (384 questions) to review the answers for all questions and replace the incorrect answers with correct answers for applicable questions.

   Source: Adapted from community discussion — BShelat

   References

   • AWS documentation

   Next question

8. Question 208 · 712 in bank

   Which AWS service allows users to download security and compliance reports about the AWS infrastructure on demand?

   • AAmazon GuardDuty
   • BAWS Security Hub
   • CAWS Artifact
   • DAWS Shield

   Show answer

   Answer: C

   Next question

9. Question 209 · 712 in bank

   An external auditor has requested that a company provide a list of all its IAM users, including the status of users' credentials and access keys. What is the SIMPLEST way to provide this information?

   • ACreate an IAM user account for the auditor, granting the auditor administrator permissions.
   • BTake a screenshot of each user's page in the AWS Management Console, then provide the screenshots to the auditor.
   • CDownload the IAM credential report, then provide the report to the auditor.
   • DDownload the AWS Trusted Advisor report, then provide the report to the auditor.

   Show answer

   Answer: C

   Explanation

   https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html Getting credential reports (console) You can use the AWS Management Console to download a credential report as a comma-separated values (CSV) file. To download a credential report (console) Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/. In the navigation pane, choose Credential report. Choose Download Report. Important Note: I am noticing that there are incorrect answers for may questions in this question set. I would request administrator of this question set (384 questions) to review the answers for all questions and replace the incorrect answers with correct answers for applicable questions.

   Source: Adapted from community discussion — BShelat

   References

   • AWS documentation
   • aws.amazon.com documentation

   Next question

10. Question 210 · 712 in bank

    Which task can a company perform by using security groups in the AWS Cloud?

    • AAllow access to an Amazon EC2 instance through only a specific port.
    • BDeny access to malicious IP addresses at a subnet level.
    • CProtect data that is cached by Amazon CloudFront.
    • DApply a stateless firewall to an Amazon EC2 instance.

    Show answer

    Answer: A

    Explanation

    https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html Security groups are stateful. For example, if you send a request from an instance, the response traffic for that request is allowed to reach the instance regardless of the inbound security group rules. Responses to allowed inbound traffic are allowed to leave the instance, regardless of the outbound rules. So "D" is NOT the answer. "A" is the correct answer.

    Source: Adapted from community discussion — BShelat

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CLF-C02 practice, question 201. 712 questions available.