CLF-C02 Security and Compliance — 20 Questions

Question 1

A company is preparing for an annual compliance audit. The auditor requests a copy of the AWS SOC 2 Type II report to review AWS's controls. Which AWS service or tool can the company use to obtain this report?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications. The company can use AWS Artifact to download the SOC 2 Type II report directly, fulfilling the auditor's request without needing to contact AWS support.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Question 2

A company has deployed multiple EC2 instances with different security groups. The compliance team wants to ensure that no security group allows unrestricted SSH access (0.0.0.0/0) and receive alerts if any such rule is created. Which AWS service can they use to continuously monitor and evaluate the security group configurations against this policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. With a managed rule like `restricted-ssh`, AWS Config can automatically detect security groups that allow unrestricted SSH access (0.0.0.0/0) and trigger alerts or remediation actions. This meets the compliance team's requirement for ongoing, rule-based evaluation of security group configurations.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 3

A company uses an IAM role to allow an application running on Amazon EC2 to decrypt data stored in Amazon S3. The security team wants to enforce that the application can only use the decryption permission when the IAM role has a specific tag (e.g., 'Environment=Production'). Which approach should the security team implement to meet this requirement?

Accepted Answer

Add a condition to the IAM policy that grants the 'kms:Decrypt' permission with a condition on 'aws:PrincipalTag' to require the tag.. Option C is correct because the condition key 'aws:PrincipalTag' in an IAM policy allows you to control access based on tags attached to the IAM principal (the role). By adding a condition that requires 'aws:PrincipalTag/Environment' to equal 'Production', the 'kms:Decrypt' permission is only effective when the IAM role has that specific tag. This directly enforces the security team's requirement at the IAM policy level, which is the appropriate place to restrict permissions based on principal attributes.

Answer

Add a condition to the KMS key policy that uses the 'kms:RequestTag/ConditionKey' to require the tag on the caller.

Answer

Add a condition to the IAM role's trust policy that denies the 'kms:Decrypt' action unless the role has the tag.

Answer

Add a condition to the S3 bucket policy that denies all access unless the IAM role has the required tag.

Question 4

A company needs to maintain a secure audit trail of all API calls made against its AWS resources. The audit trail must record the identity of the caller, the time of the call, the source IP address, and the request details. The records must be stored securely with integrity guarantees for a minimum of five years to meet compliance requirements. Which AWS service should the company use to capture and store this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing the identity of the caller, timestamp, source IP address, and request details. It stores these logs in Amazon S3 with server-side encryption and integrity validation via digest files, and can be configured to retain logs for more than five years using lifecycle policies or by archiving to Amazon S3 Glacier.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 5

A financial services company requires all data stored in Amazon S3 to be encrypted at rest. The company has a compliance policy that states encryption keys must be managed entirely by the customer and must never be stored or managed by the cloud provider. Which encryption option should the company use for Amazon S3?

Accepted Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C). SSE-C allows the customer to provide their own encryption keys for server-side encryption of S3 objects. The customer manages the keys entirely, and AWS does not store or manage them, meeting the compliance requirement that encryption keys must never be stored or managed by the cloud provider.

Answer

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)

Answer

Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS)

Answer

Client-Side Encryption using an on-premises key management system

Question 6

A company runs a web application on Amazon EC2 that connects to an Amazon RDS database. The database credentials are currently hardcoded in the application configuration file. The security team requires that the credentials be automatically rotated every 90 days and that the application retrieves them securely from a managed service without storing them in the application code. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including for Amazon RDS) on a schedule. It allows the application to fetch credentials at runtime via API calls, eliminating hardcoded secrets, and supports native rotation every 90 days without custom code.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Certificate Manager (ACM)

Question 7

A company stores sensitive customer data in multiple Amazon S3 buckets. The security team wants to proactively identify any buckets that have been configured to allow unintended access from external AWS accounts or from the public internet. The team needs a service that continuously analyzes the resource-based policies attached to these buckets and generates findings when such unintended access is detected. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it continuously analyzes resource-based policies (such as S3 bucket policies) to identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of its AWS account, including the 'Principal': '*' condition that allows public internet access. This directly meets the requirement for proactive, continuous monitoring of unintended access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 8

A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired rules. You can create a custom AWS Config rule to check that all EC2 instances have the tag 'Environment=Production' and are associated with the security group 'Prod-SG'. When a resource becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the IT team.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 9

A company runs a public-facing e-commerce website on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has discovered that attackers are attempting SQL injection attacks through the website's search feature. The company wants to use a managed AWS service to inspect incoming HTTP requests and block these malicious payloads before they reach the application. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that allows you to create rules to inspect HTTP/HTTPS requests and block common attack patterns, such as SQL injection and cross-site scripting. By associating a WAF web ACL with the Application Load Balancer, the company can filter incoming traffic and block malicious payloads before they reach the EC2 instances.

Answer

AWS Shield Standard

Answer

Network ACLs

Answer

Amazon GuardDuty

Question 10

A company is using AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that users in the development accounts cannot disable AWS CloudTrail logging or delete CloudTrail trails, even if those users have full administrator permissions within their own accounts. The team needs a central mechanism that is enforced across all development accounts regardless of individual IAM policies. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in an organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrator permissions via IAM policies. By applying an SCP that denies the `cloudtrail:DeleteTrail` and `cloudtrail:StopLogging` actions, the security team can enforce that CloudTrail cannot be disabled or deleted across all development accounts, regardless of individual IAM configurations.

Answer

IAM policies

Answer

AWS Config rules

Answer

Amazon CloudWatch Events

Question 11

A company's security policy requires that all IAM user access keys be rotated every 90 days. The security team wants to automatically identify any IAM user in the company's AWS account whose access keys are older than 90 days and trigger a notification to the security team. They need a managed AWS service that continuously evaluates the access key age against this requirement and generates findings. Which AWS service should the security team use?

Accepted Answer

AWS Config. AWS Config is a managed service that continuously evaluates your AWS resource configurations against desired policies (e.g., access keys older than 90 days) using managed rules like 'iam-user-unused-keys-check'. It generates compliance findings and can trigger notifications via Amazon EventBridge or SNS, meeting the requirement for continuous evaluation and alerting.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS IAM Access Analyzer

Question 12

A financial services company is preparing for an annual audit. The auditors have requested a copy of the AWS SOC 2 Type II report to verify the security controls of the AWS infrastructure that the company uses. The company's compliance officer needs to directly download this report from a trusted AWS source. Which AWS service should the compliance officer use to obtain the report?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 Type II reports, ISO certifications, and PCI DSS reports. The compliance officer can directly download the SOC 2 report from the AWS Artifact console or via the AWS Artifact API, ensuring the report comes from a trusted AWS source.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 13

A financial services company must comply with PCI DSS requirements that mandate the use of a dedicated hardware security module (HSM) to store encryption keys used to protect cardholder data. The company plans to use server-side encryption in Amazon S3 and needs to ensure that the encryption keys are stored in a dedicated HSM under the company's sole control. Which AWS service should the company use to meet this requirement?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated hardware security modules (HSMs) that are under the customer's sole control, meeting PCI DSS requirements for storing encryption keys in a dedicated HSM. It allows you to generate and manage your own encryption keys within a single-tenant, FIPS 140-2 Level 3 validated device, ensuring compliance with the mandate for dedicated hardware.

Answer

AWS KMS with automatic key rotation

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 14

A company runs a web application that connects to an Amazon RDS for MySQL database. The security policy requires that the database password be rotated every 30 days. The development team wants a fully managed solution that automatically rotates the password, handles the update in RDS, and provides the application with the latest credentials without any code changes. The application should also continue to work during the rotation process. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it provides a fully managed service for automatic password rotation every 30 days, directly integrates with Amazon RDS for MySQL to update the database credentials, and supplies the latest credentials to the application via the Secrets Manager API without requiring any code changes. The rotation process is designed to ensure application availability by using a staged rotation strategy (e.g., creating a new credential while the old one remains valid) so the application continues to work during the rotation.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Identity and Access Management (IAM)

Question 15

A company hosts a multi-tier web application on AWS. The web tier runs on Amazon EC2 instances in a public subnet, and the database tier runs on Amazon EC2 instances in a private subnet. The security team needs to configure security groups to allow only the web tier instances to communicate with the database tier on port 3306 (MySQL). The web tier must be accessible from the internet on port 443. Which security group configuration meets these requirements?

Accepted Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.. Option A is correct because it uses a security group reference as the source for the database security group's inbound rule on port 3306, which allows traffic only from instances associated with the web security group. The web security group allows inbound HTTPS traffic from the internet (0.0.0.0/0) on port 443, meeting the requirement for public access. This configuration ensures least-privilege access by restricting database communication to only the web tier, without exposing the database to the internet or requiring IP-based rules.

Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing 0.0.0.0/0 on port 3306.

Answer

Web security group: inbound rule allowing the web security group as source on port 443. Database security group: inbound rule allowing the web security group as source on port 3306.

Answer

Web security group: inbound rule allowing 0.0.0.0/0 on port 443. Database security group: inbound rule allowing the internet-facing Application Load Balancer security group as source on port 3306.

Question 16

A company hosts a web application behind an Application Load Balancer (ALB) in AWS. The application must comply with a security policy requiring TLS encryption for all traffic between users and the ALB. The company wants to automate the renewal of TLS certificates and avoid manual certificate management. Which AWS service should the company use to provision and automatically renew the certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it integrates directly with Application Load Balancers to provision and automatically renew TLS certificates, eliminating manual certificate management. ACM handles the entire certificate lifecycle, including renewal, which is essential for maintaining TLS encryption compliance without operational overhead.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 17

A company runs multiple workloads on AWS and must ensure that all Amazon S3 buckets have server-side encryption enabled. The compliance team wants to automatically detect any S3 bucket that is created without encryption and receive an alert. They also want to continuously monitor existing buckets for compliance. Which AWS service should they use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-server-side-encryption-enabled', which automatically checks whether each S3 bucket has server-side encryption enabled. When a non-compliant bucket is detected (either newly created or existing), AWS Config can trigger an Amazon SNS notification to alert the compliance team, meeting both the detection and alerting requirements.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 18

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Organizations service control policies (SCPs) allow a central administrator to define maximum permissions for all accounts within an organization. By creating an SCP that explicitly denies the `iam:CreateUser` action, the security team can enforce that no IAM users can be created in any member account, including future accounts, because SCPs are inherited by all accounts in the organization. This provides a single, centralized mechanism that cannot be overridden by account-level IAM policies.

Answer

AWS Identity and Access Management (IAM) policies

Answer

AWS Config managed rules with automatic remediation

Answer

IAM Access Analyzer

Question 19

A company stores sensitive documents in Amazon S3. The security team wants a preventive control that ensures no S3 bucket in the AWS account can ever be configured with a bucket policy that grants public read or write access. This control must apply automatically to all newly created buckets and to existing buckets, without requiring changes to individual bucket policies. Which AWS feature should the security team use?

Accepted Answer

Amazon S3 Block Public Access at the account level. Amazon S3 Block Public Access at the account level is a preventive control that, when enabled, overrides any bucket policies or ACLs that would grant public read or write access. It applies automatically to all existing and newly created buckets in the account without requiring changes to individual bucket policies. This meets the security team's requirement for a blanket, account-wide preventive control.

Answer

AWS Config with the s3-bucket-public-read-prohibited managed rule

Answer

AWS Identity and Access Management (IAM) policy with a condition that denies s3:PutBucketPolicy for any action that grants public access

Answer

Amazon GuardDuty with a finding suppression rule for S3 public access events

Question 20

A company uses AWS Organizations to manage multiple AWS accounts. The security team must ensure that all API activity across all accounts, including any new accounts added in the future, is recorded and delivered to a centralized S3 bucket for auditing. The solution should require minimal ongoing manual effort. Which AWS feature should the security team use?

Accepted Answer

Create an AWS CloudTrail organization trail that logs events for all accounts in the organization.. Option B is correct because AWS CloudTrail organization trails automatically log events for all accounts in an AWS Organization, including any new accounts added in the future, and deliver them to a single S3 bucket without requiring per-account configuration. This satisfies the requirement for minimal ongoing manual effort and centralized auditing.

Answer

Enable AWS CloudTrail in each account individually and configure the S3 bucket to allow cross-account access from the audit account.

Answer

Use AWS Config to record API calls and deliver configuration history to an S3 bucket.

Answer

Set up Amazon GuardDuty to monitor API activity and send findings to a centralized S3 bucket.