CLF-C02 Security and Compliance Practice Test 10 — 15 Questions

Question 1

A company uses multiple AWS accounts to store data in Amazon S3. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled. The team needs a service that can continuously monitor all S3 bucket configurations across all accounts, automatically detect any bucket that does not have encryption enabled, and automatically apply the encryption setting to bring the bucket into compliance. Which AWS service should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. Using a managed rule like 's3-bucket-server-side-encryption-enabled', AWS Config can automatically detect S3 buckets that lack server-side encryption and, through AWS Config rules with auto-remediation (via Systems Manager Automation or Lambda), automatically apply the encryption setting to bring non-compliant buckets into compliance.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 2

A company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team has noticed an increase in volumetric distributed denial-of-service (DDoS) attacks targeting the application's IP address. The company wants a managed AWS service that provides automatic, always-on protection against common network-layer DDoS attacks at no additional cost. Which AWS service should the company use?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is the correct choice because it provides automatic, always-on protection against common network-layer (Layer 3/4) DDoS attacks, such as SYN floods and UDP reflection attacks, at no additional cost. It is integrated with Elastic Load Balancing (ELB), Amazon CloudFront, and Amazon Route 53, making it ideal for protecting a public-facing web application behind an Application Load Balancer without requiring any configuration or extra fees.

Answer

AWS WAF

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Question 3

A company's security policy prohibits opening SSH (port 22) or RDP (port 3389) to the internet for any Amazon EC2 instance. The operations team needs a way to establish secure shell sessions to manage instances directly from the AWS Management Console without managing bastion hosts or SSH keys. Which AWS service provides this capability?

Accepted Answer

AWS Systems Manager Session Manager. AWS Systems Manager Session Manager enables secure shell access to EC2 instances directly from the AWS Management Console without opening inbound ports (22 or 3389) or managing bastion hosts. It uses the SSM Agent and AWS Identity and Access Management (IAM) policies to establish a bidirectional connection over HTTPS (port 443), eliminating the need for SSH keys or public IP addresses. This fully satisfies the security policy requirement while providing the desired management capability.

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Answer

Amazon GuardDuty

Question 4

A company stores sensitive financial reports in an Amazon S3 bucket. The company's security policy mandates that all objects be encrypted at rest using an AWS KMS customer-managed key. The security team wants to ensure that only the 'Auditors' IAM role can decrypt the objects, even though the S3 bucket policy allows read access to a broader set of users. Which of the following steps must the security team take to enforce this access control?

Accepted Answer

Configure the S3 bucket to use SSE-KMS encryption with the customer-managed key, and modify the KMS key policy to grant the kms:Decrypt permission only to the 'Auditors' role.. SSE-KMS with a customer-managed key separates encryption key management from S3 bucket policies. The KMS key policy is the authoritative access control for decryption operations. By granting kms:Decrypt only to the 'Auditors' role, even if the S3 bucket policy allows s3:GetObject to other users, they cannot decrypt the objects without the key permission. This enforces the security requirement that only the Auditors role can decrypt the sensitive financial reports.

Answer

Configure an S3 bucket policy that denies s3:GetObject requests unless the request is encrypted in transit using HTTPS.

Answer

Enable S3 Block Public Access on the bucket and attach an IAM policy to the 'Auditors' role that allows s3:GetObject.

Answer

Use S3 object-level logging to monitor access and revoke permissions for any role that attempts to decrypt objects without authorization.

Question 5

A company stores sensitive customer data in an Amazon S3 bucket. The security team wants to record every GetObject and PutObject API call made against the bucket, including the identity of the caller, the source IP address, and the time of the request. They need to store these records in a separate centralized S3 bucket and analyze them using Amazon Athena for security audits. Which AWS feature should the security team enable?

Accepted Answer

AWS CloudTrail data events. AWS CloudTrail data events (Option C) are the correct choice because they capture detailed information about S3 object-level API operations such as GetObject and PutObject, including the caller identity, source IP address, and request time. These logs can be delivered to a centralized S3 bucket and queried using Amazon Athena for security audits, meeting all stated requirements.

Answer

AWS Config managed rules

Answer

Amazon S3 server access logging

Answer

Amazon GuardDuty

Question 6

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses a custom domain name and requires HTTPS for all traffic. The security team provisions an SSL/TLS certificate using AWS Certificate Manager (ACM) and associates it with the ALB. Which of the following is an advantage of using ACM over manually managing certificates?

Accepted Answer

ACM automatically renews the certificate before it expires, and the renewed certificate is automatically applied to the associated load balancer.. AWS Certificate Manager (ACM) automatically renews SSL/TLS certificates before they expire, and the renewed certificate is seamlessly applied to the associated AWS resources, such as an Application Load Balancer (ALB). This eliminates the manual effort of tracking expiration dates, generating new certificates, and re-associating them, which is a key operational advantage over self-managed certificates.

Answer

ACM encrypts the traffic between the ALB and the EC2 instances, ensuring end-to-end encryption.

Answer

ACM provides a certificate that can be exported and installed on any on-premises server for free.

Answer

ACM requires the company to store the private key in a secure location outside of AWS.

Question 7

A company uses AWS Organizations and manages hundreds of AWS accounts. The security policy requires that all Amazon S3 buckets be encrypted using a specific AWS KMS customer-managed key (CMK). The security team wants to automatically detect any S3 bucket that is not encrypted with the required CMK and automatically apply the correct encryption configuration without manual intervention. Which AWS service should the security team use to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-kms-encryption-specific-key) that can evaluate whether S3 buckets are encrypted with the required KMS customer-managed key. When a noncompliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule to automatically apply the correct encryption configuration, enabling automated remediation without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 8

A company runs a web application on Amazon EC2 instances. Under the AWS Shared Responsibility Model, who is responsible for patching the operating system on the EC2 instances?

Accepted Answer

The customer, because OS patching is in the customer's area of responsibility for IaaS services. Under the AWS Shared Responsibility Model, for Infrastructure as a Service (IaaS) like EC2, the customer is responsible for managing the guest operating system, including patching and security updates. AWS is responsible for the physical infrastructure and the hypervisor layer, but not for the OS running inside the EC2 instance. Therefore, option B is correct.

Answer

AWS, because they own and operate all EC2 infrastructure

Answer

Both AWS and the customer equally share this responsibility

Answer

A third-party managed service provider designated by AWS

Question 9

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The security team requires that no long-term access keys be stored on the instance. Which IAM feature should be used to grant the EC2 instance permission to access S3?

Accepted Answer

Attach an IAM role to the EC2 instance. An IAM role can be attached to an EC2 instance, allowing the instance to obtain temporary security credentials from AWS STS via the instance metadata service. This eliminates the need to store long-term access keys on the instance, satisfying the security team's requirement. The EC2 instance automatically rotates these temporary credentials before they expire, providing secure, programmatic access to the S3 bucket.

Answer

Create an IAM user and embed the access key in the application code

Answer

Store the access key in an EC2 environment variable

Answer

Use an IAM group to assign the permissions to the EC2 instance

Question 10

A company hires 10 new developers and needs to assign them identical AWS permissions — read access to S3 and the ability to launch EC2 instances. What is the AWS best practice for assigning these permissions efficiently?

Accepted Answer

Create an IAM group, attach the required policies to the group, and add all 10 users to the group. IAM groups allow administrators to assign permissions to multiple users at once. By creating a 'Developers' group with the required policies and adding all 10 users to it, permissions are managed centrally. Adding a policy to the group affects all members simultaneously.

Answer

Attach an inline policy to each of the 10 IAM users individually

Answer

Create one IAM user account and share the credentials with all 10 developers

Answer

Grant the developers root account access with MFA enabled

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to prevent accounts in the 'Development' OU from launching any resources in regions outside of us-east-1 and eu-west-1. Which AWS Organizations feature allows this restriction?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) are the correct AWS Organizations feature because they allow you to centrally control the maximum available permissions for all accounts within an OU. By attaching an SCP that denies all actions in regions other than us-east-1 and eu-west-1, the security team can enforce this restriction across all 'Development' accounts, even if IAM policies within those accounts allow broader access.

Answer

IAM permission boundaries

Answer

Resource-based policies attached to each S3 bucket

Answer

AWS Config rules across all accounts

Question 12

A security auditor needs to know which IAM user deleted a specific S3 bucket last week, from which IP address the action was taken, and at what exact time. Which AWS service captures this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including S3 bucket deletion actions (DeleteBucket). It captures the identity of the IAM user, the source IP address, and the exact timestamp of each API call, which directly meets the auditor's requirements.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

A company wants all IAM users to verify their identity with both a password and a one-time code from an authenticator app before accessing the AWS Management Console. Which security control should the company enable?

Accepted Answer

Multi-Factor Authentication (MFA). Multi-Factor Authentication (MFA) is the correct security control because it requires users to present two independent factors: something they know (password) and something they have (a one-time code from an authenticator app). This satisfies the company's requirement for both a password and a one-time code before accessing the AWS Management Console, significantly reducing the risk of unauthorized access even if a password is compromised.

Answer

AWS Shield

Answer

AWS WAF

Answer

Amazon Cognito

Question 14

A company's public-facing web application is being attacked with SQL injection and cross-site scripting (XSS) attempts. Which AWS service should they deploy to detect and block these web application attacks?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It allows you to create custom rules to filter and monitor HTTP(S) requests based on conditions such as IP addresses, HTTP headers, or request body patterns, and can block malicious traffic before it reaches your application.

Answer

AWS Shield Standard

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 15

A company is concerned about Distributed Denial of Service (DDoS) attacks against their website hosted on AWS. They want basic DDoS protection without incurring additional cost. Which AWS service provides automatic DDoS protection at no extra charge?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides basic protection against common infrastructure-layer DDoS attacks, such as SYN/UDP floods and reflection attacks. This matches the requirement for automatic, no-cost DDoS protection without any manual configuration or subscription.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced