Free CLF-C01 Practice Test

AWS Certificate Manager (ACM) is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources. SSL/TLS certificates are used to secure network communications and establish the identity of websites over the internet. ACM handles the complexity of creating and managing these certificates, which are essential for enabling encrypted HTTPS traffic for a web application.

A. AWS WAF is a web application firewall that protects against common web exploits. It does not provision or manage SSL/TLS certificates.
B. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. Its purpose is to safeguard applications, not to manage encryption certificates.
C. Amazon VPC provides an isolated network environment. While it is a foundational security component, it does not handle SSL/TLS certificate management for web traffic.

1. AWS Certificate Manager. (n.d.). AWS Documentation. Retrieved from https://aws.amazon.com/certificate-manager/. (See "What is AWS Certificate Manager?" section).

2. AWS Well-Architected Framework. (2023). Security Pillar. Whitepaper. Page 37. Retrieved from https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/wellarchitected-security-pillar.pdf. (Discusses implementing a secure network configuration, including encryption in transit).

Serverless applications, such as those using AWS Lambda, are characterized by abstracting server management away from the user. A key benefit is built-in fault tolerance, as services like Lambda automatically run code across multiple Availability Zones to ensure high availability. Another core characteristic is automatic scaling; the service scales compute resources up or down in response to demand, from zero to thousands of requests per second. Users do not provision or manage any servers, operating systems, or underlying infrastructure.

A. Serverless computing is defined by the absence of manual server configuration. Users do not manage or configure Amazon EC2 instances.
B. In a serverless model like AWS Lambda, the cloud provider manages the underlying operating system; the user does not choose or configure it.
D. Amazon EC2 Spot Instances are a cost-saving option for running server-based workloads on EC2, which is the opposite of the serverless model.

1. AWS. (2023). What is Serverless?. AWS Serverless. Retrieved from https://aws.amazon.com/serverless/ (See section "Benefits of serverless," which lists "No server management," "Flexible scaling," and "High availability").

2. AWS Lambda Developer Guide. (2023). AWS Lambda features. AWS Documentation. Retrieved from https://docs.aws.amazon.com/lambda/latest/dg/features.html (See sections on "Automatic scaling" and "Built-in fault tolerance").

The company needs to migrate a Microsoft SQL Server database to AWS while reducing operational overhead and avoiding application refactoring. Amazon RDS for SQL Server is a managed database service that automates time-consuming administration tasks such as hardware provisioning, database setup, patching, and backups. This directly addresses the need to reduce operational overhead. Since it is a fully managed SQL Server environment, it allows the company to migrate its existing database with minimal to no changes, thus avoiding the need for refactoring. This makes it the most effective solution for the given requirements.

A. Amazon DynamoDB is a NoSQL database. Migrating from a relational database like SQL Server would require a significant application refactor, which the company wants to avoid.
B. Amazon Redshift is a data warehousing service, optimized for analytical queries, not for the transactional workloads of a typical application database.
C. Microsoft SQL Server on Amazon EC2 requires the company to manage the operating system and database software, which does not reduce operational overhead.

1. AWS. (n.d.). Amazon RDS for SQL Server. AWS Documentation. Retrieved from https://aws.amazon.com/rds/sql/

"Amazon RDS makes it easy to set up, operate, and scale SQL Server deployments in the cloud. With Amazon RDS, you can deploy multiple editions of SQL Server...in minutes with cost-efficient and resizable compute capacity."

2. AWS. (n.d.). What is Amazon Relational Database Service (Amazon RDS)?. AWS Documentation.

"Amazon RDS is a managed service... It frees you to focus on your applications so you can give them the fast performance, high availability, security, and compatibility they need."

AWS CodeCommit is a fully managed source control service that hosts secure and private Git repositories. It eliminates the need to operate your own source control system or worry about scaling its infrastructure. CodeCommit is designed for teams to collaborate on code in a secure and highly scalable ecosystem, making it the ideal service for hosting repositories and managing version control as described in the scenario.

A. AWS CodeStar is a unified user interface for managing the entire software development lifecycle, not a source control service itself.
B. Amazon CodeGuru is a machine learning-powered service that provides intelligent recommendations to improve code quality and identify an application’s most expensive lines of code.
D. AWS CodePipeline is a continuous delivery service that automates the build, test, and deploy phases of your release process. It uses a source like CodeCommit but does not host the code.

1. AWS Documentation. (2023). What Is AWS CodeCommit?. AWS CodeCommit User Guide. Retrieved from https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html (See the "What Is AWS CodeCommit?" section, Para. 1).

2. AWS Documentation. (2023). AWS Developer Tools. Retrieved from https://aws.amazon.com/products/developer-tools/ (See the "Source" category, which lists AWS CodeCommit).

AWS Managed Services (AMS) is designed to offload the operational burden of infrastructure management. It helps enterprises by provisioning, running, and supporting their AWS infrastructure, allowing the company's IT team to focus on applications rather than underlying operations. AMS automates common activities such as change requests, monitoring, patch management, security, and backup services. This directly addresses the company's goal of offloading workload support.

B. Building hardware refreshes into the calendar is an on-premises operational model that cloud migration aims to eliminate.
C. Using Amazon ECS on EC2 instances still requires the IT team to manage the underlying EC2 instances, which does not fully offload support.
D. Overprovisioning is an inefficient and costly strategy that cloud elasticity helps avoid; it does not offload the support burden.

1. AWS Managed Services. (n.d.). AWS Managed Services Features. Retrieved from aws.amazon.com/managed-services/features/. In the "How it works" section, it states, "AWS Managed Services (AMS) operates AWS on your behalf, providing a secure and compliant AWS Landing Zone, a proven enterprise operating model, on-going cost optimization, and day-to-day infrastructure management."

2. AWS Whitepapers. (2022, April). Overview of Amazon Web Services. WP-1. Page 41. "AWS Managed Services helps you operate your AWS infrastructure more efficiently and securely. It provides ongoing management of your AWS infrastructure so you can focus on your applications."

Migrating from an on-premises data center to the AWS Cloud allows a company to trade large capital expenses for variable operational expenses. The company eliminates the need to purchase and maintain physical server hardware. It also eliminates the costs associated with running a physical data center, such as power, cooling, physical security, and real estate. AWS manages the physical infrastructure, allowing the company to focus on its applications and customers rather than on managing hardware and facilities.

B. Cost of application licensing is not necessarily eliminated; companies may still need to pay for software licenses, although they can sometimes leverage a bring-your-own-license (BYOL) model or purchase licenses through AWS Marketplace.
C. Cost of marketing campaigns is a business expense unrelated to IT infrastructure and is not affected by a cloud migration.
E. Cost of network management is not eliminated but shifted; companies still manage their virtual network (VPC) but no longer manage physical network hardware.

1. AWS. (2022). Six Advantages of Cloud Computing. AWS Whitepaper. Retrieved from https://d1.awsstatic.com/whitepapers/aws-6-advantages-of-cloud-computing.pdf (Page 2, "Trade capital expense for variable expense" and "Stop spending money running and maintaining data centers").

2. AWS. (2023). Overview of Amazon Web Services. AWS Whitepaper. Retrieved from https://d1.awsstatic.com/whitepapers/aws-overview.pdf (Page 5, Section "Benefits of the AWS Cloud").

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides protection against most common, network and transport layer DDoS attacks that target your website or applications. For higher levels of protection against more sophisticated and larger attacks, AWS Shield Advanced is available. It is the specific service designed for automatic DDoS mitigation.

A. A network access control list (ACL) is a stateless firewall for a subnet that is used for manually allowing or denying traffic. It is not an automatic DDoS mitigation tool.
C. A security group is a stateful firewall for an EC2 instance. It is not designed to mitigate large-scale, volumetric DDoS attacks.
D. Amazon GuardDuty is a threat detection service that monitors for malicious activity but does not actively block or mitigate DDoS attacks.

1. AWS Documentation. (2023). What is AWS Shield?. AWS Shield Developer Guide. Retrieved from https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html. The introduction states, "AWS Shield is a managed distributed denial of service (DDoS) protection service that safeguards applications running on AWS... All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge."

2. AWS Documentation. (2023). AWS Best Practices for DDoS Resiliency (AWS Whitepaper). Retrieved from https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/welcome.html. Section "AWS Shield" describes its function as the primary service for DDoS protection.

The AWS account root user has unrestricted access to all resources in the account. For security, AWS restricts certain sensitive, account-level actions to only be performed by this user. These tasks include changing the AWS Support plan, modifying root user credentials, and closing an AWS account. AWS best practices strongly recommend creating and using AWS Identity and Access Management (IAM) users with specific, limited permissions for all routine administrative and operational tasks.

B. Modifying an Amazon EC2 instance type is a standard operational task that can and should be delegated to an IAM user with appropriate permissions.
C. Grouping resources in AWS Systems Manager is an organizational task that can be performed by an IAM user with the necessary permissions.
D. Running applications in Amazon EKS is an operational workload management task that should be performed by an IAM user or role, not the root user.

1. AWS Identity and Access Management User Guide. (2023). Tasks that require root user credentials. AWS Documentation. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html. (This page explicitly lists "Change your AWS Support plan" and "Close your AWS account" as tasks requiring the root user.)

2. AWS Identity and Access Management User Guide. (2023). Security best practices in IAM. AWS Documentation. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials. (This section advises locking away root user credentials and not using them for everyday tasks.)

Amazon Virtual Private Cloud (Amazon VPC) enables you to provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways. This service provides the isolated virtual network required to connect services and resources securely.

A. Amazon EC2 provides scalable computing capacity (virtual servers). These instances run within a VPC but do not provide the network itself.
B. Amazon DynamoDB is a fully managed NoSQL database service. It is a database, not a networking service.
C. Amazon Lightsail is a simplified service offering virtual private servers, but Amazon VPC is the underlying, foundational service that provides the isolated network.

1. AWS Documentation. (2023). What is Amazon VPC?. Amazon VPC User Guide. Retrieved from https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html (See the "Amazon VPC concepts" section, Para. 1).

2. AWS Whitepapers. (2021). AWS Well-Architected Framework. Retrieved from https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html (The framework consistently refers to VPC as the service for network isolation in the Security and Reliability pillars).

AWS Personal Health Dashboard provides a personalized view of the health of AWS services and alerts when your resources are affected by AWS events. It gives you proactive notifications and guidance to help you plan for scheduled activities or respond to events that might impact your specific AWS resources. This is distinct from the public Service Health Dashboard, which shows the general status of all AWS services without being specific to an individual account's resources.

B. AWS Service Health Dashboard displays the general status of AWS services publicly but is not personalized to a company's specific resources.
C. AWS Trusted Advisor provides recommendations for cost optimization, performance, and security, but it does not issue alerts for AWS service events.
D. AWS Infrastructure Event Management is a paid support service for planning and executing large-scale events, not a monitoring and alerting tool.

1. AWS Documentation. (n.d.). What is the AWS Personal Health Dashboard? AWS Health Dashboard. Retrieved from https://docs.aws.amazon.com/health/latest/ug/what-is-aws-health.html (See the "AWS Personal Health Dashboard" section, para. 1).

2. AWS Documentation. (n.d.). Comparing AWS Service Health Dashboard and AWS Personal Health Dashboard. AWS Health Dashboard. Retrieved from https://docs.aws.amazon.com/health/latest/ug/comparing-service-health-dashboard.html (The entire page compares the two services, highlighting the personalized nature of the Personal Health Dashboard).

3. AWS Documentation. (n.d.). How AWS Trusted Advisor works. AWS Support. Retrieved from https://docs.aws.amazon.com/awssupport/latest/user/how-trusted-advisor-works.html (Describes Trusted Advisor's function as an optimization tool, not an event alerting service).