CLF-C02 Security and Compliance — 30 Questions

Question 1

A financial services company requires all data stored in Amazon S3 to be encrypted at rest. The company has a compliance policy that states encryption keys must be managed entirely by the customer and must never be stored or managed by the cloud provider. Which server-side encryption option should the company use for Amazon S3?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C). SSE-C allows the customer to provide their own encryption keys for server-side encryption of S3 objects. The customer manages the keys entirely, and AWS does not store or manage them, meeting the compliance requirement that encryption keys must never be stored or managed by the cloud provider.

Answer

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)

Answer

Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS)

Answer

Client-Side Encryption using an on-premises key management system

Question 2

A company has a security policy that requires all SSH connections to Amazon EC2 instances to originate from the company's corporate network IP range (203.0.113.0/24). An administrator is creating an IAM policy to enforce this restriction. Which IAM policy element should the administrator use to specify the allowed IP address range?

Accepted Answer

aws:SourceIp condition key. SSH connections to EC2 instances are network traffic, not AWS API calls. IAM policies cannot restrict SSH source IP addresses. None of the listed IAM condition keys (including aws:SourceIp) can enforce this requirement. The correct solution is a security group or network ACL allowing inbound TCP 22 only from 203.0.113.0/24. As written, this question has no correct option among A-D.

Answer

aws:RequestedRegion condition key

Answer

aws:PrincipalOrgID condition key

Answer

aws:MultiFactorAuthPresent condition key

Question 3

A company must store sensitive financial records in Amazon S3. The compliance policy mandates that the encryption key for data at rest must be generated and stored on the company's own on-premises hardware security module (HSM). The company must never allow AWS to have access to the plaintext encryption key. Which Amazon S3 encryption option should the company use?

Accepted Answer

Client-side encryption using the AWS Encryption SDK. Client-side encryption using the AWS Encryption SDK encrypts data on the client side before uploading to S3. The encryption key is generated and stored on the company's on-premises HSM and is never shared with AWS. Therefore, AWS never has access to the plaintext key, satisfying the compliance mandate.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Server-Side Encryption with AWS Key Management Service (SSE-KMS) using a customer managed key

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 4

A company manages multiple AWS accounts under AWS Organizations. The security team wants to enforce a policy that prohibits launching Amazon EC2 instances of instance families g (GPU) and p (GPU) across all accounts to control costs. The team needs a centralized method to block these instance types at the organization level, and the policy must be applied proactively before any instance is launched. Which AWS solution should the team use?

Accepted Answer

Apply an AWS Organizations Service Control Policy (SCP) that denies ec2:RunInstances when the requested instance type belongs to the g or p families.. AWS Organizations Service Control Policies (SCPs) are the only centralized mechanism that can proactively deny API actions across all accounts in the organization before the action occurs. By creating an SCP with a Deny effect on ec2:RunInstances where the instance type matches 'g*' or 'p*', the security team enforces the restriction at the root, OU, or account level, preventing any user or role from launching GPU instances regardless of their IAM permissions.

Answer

Create an AWS IAM policy with a Deny effect for ec2:RunInstances where the instance type starts with 'g' or 'p' and attach it to a specific IAM role in each account.

Answer

Use an AWS Config managed rule to detect GPU instance launches and trigger an auto-remediation action that terminates the instances.

Answer

Use AWS Trusted Advisor cost optimization checks to identify GPU instances and then manually disable them in each account.

Question 5

A company is migrating a legacy application from an on-premises server to AWS Lambda. The Lambda function needs to connect to an Amazon RDS for MySQL database that stores sensitive customer data. The security team requires that database credentials are never stored in the function's code, environment variables, or configuration files. The solution must follow AWS best practices for securing database access. Which approach should the company use?

Accepted Answer

Store the database password in AWS Secrets Manager and retrieve it from within the Lambda function code.. AWS Secrets Manager is the AWS best practice for securely storing and retrieving database credentials for Lambda functions. It stores the password outside the function code, environment variables, and configuration files, and supports automatic rotation. While Parameter Store SecureString can store encrypted credentials, Secrets Manager is the recommended service for database credentials. IAM database authentication can eliminate static passwords but is not the primary answer for storing and handling database credentials in this scenario.

Answer

Store the database password in AWS Systems Manager Parameter Store as a SecureString and retrieve it from within the Lambda function.

Answer

Configure the Lambda function to use an IAM role with permissions to connect to the RDS database using IAM database authentication.

Answer

Encrypt the database password using AWS KMS and hardcode the encrypted password in the Lambda function code.

Question 6

A company manages multiple AWS accounts under a single AWS Organizations organization. The security team wants to implement a preventive control that blocks any action that would disable AWS CloudTrail or delete CloudTrail log files across all accounts, including the management account. The solution must be centrally managed and must not require changes to individual account permissions. Which AWS feature should the security team use?

Accepted Answer

AWS Service Control Policies (SCPs). AWS Service Control Policies (SCPs) apply to all member accounts in an organization, but they explicitly do not apply to the management account. The management account retains full permissions and cannot be restricted by SCPs. Therefore, an SCP cannot block actions in the management account. No other option provides a preventive control across all accounts including the management account without requiring per-account permission changes, making the question invalid as written.

Answer

IAM permission boundaries

Answer

AWS Identity and Access Management (IAM) roles with a trust policy

Answer

AWS Config conformance packs

Question 7

A company wants to protect their S3 buckets from accidental or malicious data exfiltration by ensuring that data can only leave the VPC through S3 endpoint conditions. Which IAM policy condition controls this?

Accepted Answer

S3 bucket policy with aws:SourceVpc condition. The `aws:SourceVpc` condition key is used in S3 bucket policies (resource-based policies) to restrict access to a specific VPC. By denying requests that do not originate from the designated VPC, you ensure data can only leave the VPC through the S3 VPC endpoint, preventing exfiltration over the public internet. VPC endpoint policies themselves control which actions and resources are allowed through the endpoint, but they do not use the `aws:SourceVpc` condition key.

Answer

S3 Block Public Access

Answer

S3 CORS configuration

Answer

Amazon Macie sensitive data classification

Question 8

Which AWS service evaluates password policy configuration, reviews IAM users, and provides security recommendations to help assess the security posture of an AWS account?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor is the correct answer because it performs account-level security checks, including reviewing IAM users for unused keys/MFA and evaluating the account's password policy configuration. Password policies are configured by an IAM administrator; Trusted Advisor checks their settings and provides security recommendations rather than generating policies or assigning a security score.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

Amazon Macie

Question 9

Which IAM best practice helps prevent unauthorized access if an IAM user's long-term credentials are compromised?

Accepted Answer

Using IAM roles instead of IAM users. Using IAM roles instead of IAM users eliminates the existence of long-term credentials (passwords and access keys), so there are no long-term credentials to be compromised. Temporary credentials from IAM roles are short-lived and automatically rotated. MFA adds a second factor but only for console sign-in; it does not protect API calls made with leaked access keys. Least privilege and key rotation limit damage but do not prevent unauthorized access.

Answer

Granting least privilege permissions

Answer

Enabling Multi-Factor Authentication (MFA)

Answer

Rotating access keys quarterly

Question 10

A company is preparing for an annual compliance audit. The auditor requests a copy of the AWS SOC 2 Type II report to review AWS's controls. Which AWS service or tool can the company use to obtain this report?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications. The company can use AWS Artifact to download the SOC 2 Type II report directly, fulfilling the auditor's request without needing to contact AWS support.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Question 11

A company has deployed multiple EC2 instances with different security groups. The compliance team wants to ensure that no security group allows unrestricted SSH access (0.0.0.0/0) and receive alerts if any such rule is created. Which AWS service can they use to continuously monitor and evaluate the security group configurations against this policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. With a managed rule like `restricted-ssh`, AWS Config can automatically detect security groups that allow unrestricted SSH access (0.0.0.0/0) and trigger alerts or remediation actions. This meets the compliance team's requirement for ongoing, rule-based evaluation of security group configurations.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 12

A company uses an IAM role to allow an application running on Amazon EC2 to decrypt data stored in Amazon S3. The security team wants to enforce that the application can only use the decryption permission when the IAM role has a specific tag (e.g., 'Environment=Production'). Which approach should the security team implement to meet this requirement?

Accepted Answer

Add a condition to the IAM policy that grants the 'kms:Decrypt' permission with a condition on 'aws:PrincipalTag' to require the tag.. The condition key 'aws:PrincipalTag' in an IAM policy allows you to control access based on tags attached to the IAM principal (the role). By adding a condition that requires 'aws:PrincipalTag/Environment' to equal 'Production', the 'kms:Decrypt' permission is only effective when the IAM role has that specific tag. This directly enforces the security team's requirement at the IAM policy level, which is the appropriate place to restrict permissions based on principal attributes.

Answer

Add a condition to the KMS key policy that uses the 'kms:RequestTag/ConditionKey' to require the tag on the caller.

Answer

Add a condition to the IAM role's trust policy that denies the 'kms:Decrypt' action unless the role has the tag.

Answer

Add a condition to the S3 bucket policy that denies all access unless the IAM role has the required tag.

Question 13

A company needs to maintain a secure audit trail of all API calls made against its AWS resources. The audit trail must record the identity of the caller, the time of the call, the source IP address, and the request details. The records must be stored securely with integrity guarantees for a minimum of five years to meet compliance requirements. Which AWS service should the company use to capture and store this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing the identity of the caller, timestamp, source IP address, and request details. It stores these logs in Amazon S3 with server-side encryption and integrity validation via digest files, and can be configured to retain logs for more than five years using lifecycle policies or by archiving to Amazon S3 Glacier.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 14

A company runs a web application on Amazon EC2 that connects to an Amazon RDS database. The database credentials are currently hardcoded in the application configuration file. The security team requires that the credentials be automatically rotated every 90 days and that the application retrieves them securely from a managed service without storing them in the application code. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including for Amazon RDS) on a schedule. It allows the application to fetch credentials at runtime via API calls, eliminating hardcoded secrets, and supports native rotation every 90 days without custom code.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Certificate Manager (ACM)

Question 15

A company stores sensitive customer data in multiple Amazon S3 buckets. The security team wants to proactively identify any buckets that have been configured to allow unintended access from external AWS accounts or from the public internet. The team needs a service that continuously analyzes the resource-based policies attached to these buckets and generates findings when such unintended access is detected. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it continuously analyzes resource-based policies (such as S3 bucket policies) to identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of its AWS account, including the 'Principal': '*' condition that allows public internet access. This directly meets the requirement for proactive, continuous monitoring of unintended access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 16

A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired rules. You can create a custom AWS Config rule to check that all EC2 instances have the tag 'Environment=Production' and are associated with the security group 'Prod-SG'. When a resource becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the IT team.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 17

A company runs a public-facing e-commerce website on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has discovered that attackers are attempting SQL injection attacks through the website's search feature. The company wants to use a managed AWS service to inspect incoming HTTP requests and block these malicious payloads before they reach the application. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that allows you to create rules to inspect HTTP/HTTPS requests and block common attack patterns, such as SQL injection and cross-site scripting. By associating a WAF web ACL with the Application Load Balancer, the company can filter incoming traffic and block malicious payloads before they reach the EC2 instances.

Answer

AWS Shield Standard

Answer

Network ACLs

Answer

Amazon GuardDuty

Question 18

A company is using AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that users in the development accounts cannot disable AWS CloudTrail logging or delete CloudTrail trails, even if those users have full administrator permissions within their own accounts. The team needs a central mechanism that is enforced across all development accounts regardless of individual IAM policies. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in an organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrator permissions via IAM policies. By applying an SCP that denies the `cloudtrail:DeleteTrail` and `cloudtrail:StopLogging` actions, the security team can enforce that CloudTrail cannot be disabled or deleted across all development accounts, regardless of individual IAM configurations.

Answer

IAM policies

Answer

AWS Config rules

Answer

Amazon CloudWatch Events

Question 19

A company's security policy requires that all IAM user access keys be rotated every 90 days. The security team wants to automatically identify any IAM user in the company's AWS account whose access keys are older than 90 days and trigger a notification to the security team. They need a managed AWS service that continuously evaluates the access key age against this requirement and generates findings. Which AWS service should the security team use?

Accepted Answer

AWS Config. AWS Config is a managed service that continuously evaluates your AWS resource configurations against desired policies (e.g., access keys older than 90 days) using the managed rule 'access-keys-rotated'. It generates compliance findings and can trigger notifications via Amazon EventBridge or SNS, meeting the requirement for continuous evaluation and alerting.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS IAM Access Analyzer

Question 20

A financial services company is preparing for an annual audit. The auditors have requested a copy of the AWS SOC 2 Type II report to verify the security controls of the AWS infrastructure that the company uses. The company's compliance officer needs to directly download this report from a trusted AWS source. Which AWS service should the compliance officer use to obtain the report?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 Type II reports, ISO certifications, and PCI DSS reports. The compliance officer can directly download the SOC 2 report from the AWS Artifact console or via the AWS Artifact API, ensuring the report comes from a trusted AWS source.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector