CLF-C02 Security and Compliance Practice Test 11 — 15 Questions

Question 1

A compliance officer needs to download AWS's SOC 2 Type II report and ISO 27001 certification to provide to their company's auditors as evidence that the AWS infrastructure meets regulatory standards. Where should they access these documents?

Accepted Answer

AWS Artifact. AWS Artifact is the central resource for downloading AWS compliance reports, including SOC 2 Type II reports and ISO 27001 certifications. It provides on-demand access to these documents, which auditors require as evidence of AWS's adherence to regulatory standards. This service is specifically designed for compliance and audit use cases, making it the correct choice.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS Config

Question 2

A security team wants to automatically scan their Amazon EC2 instances for known software vulnerabilities (CVEs) and assess whether any instances have unintended network access paths open. Which AWS service performs these automated security assessments?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is specifically designed to perform automated vulnerability scans (including CVEs) and network reachability assessments on EC2 instances. It uses a combination of AWS security best practices and common vulnerability databases to identify software vulnerabilities and unintended network access paths, such as open ports or overly permissive security groups.

Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS Shield

Question 3

A developer needs to read objects from a specific Amazon S3 bucket. Following AWS security best practices, which approach should be used when creating the IAM policy for this developer?

Accepted Answer

Grant only s3:GetObject permission on the specific bucket. Option C is correct because the principle of least privilege dictates granting only the specific permissions required for the task. By attaching an IAM policy with only the s3:GetObject action on the specific bucket ARN, the developer can read objects without having unnecessary permissions that could lead to accidental or malicious changes. This approach aligns with AWS security best practices for IAM policies.

Answer

Grant AdministratorAccess to ensure all required permissions are included

Answer

Grant AmazonS3FullAccess to cover all S3 operations

Answer

Use the root account credentials since they guarantee access

Question 4

A compliance team needs to track the configuration history of AWS resources, determine when a security group was last modified, and verify that all EC2 instances comply with a rule requiring encryption on all attached EBS volumes. Which AWS service provides these capabilities?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides configuration history of AWS resources, tracks changes to security groups (including last modification time), and allows you to define rules—such as requiring encryption on all EBS volumes attached to EC2 instances—and evaluate resources against those rules. It records configuration changes as configuration items and can trigger evaluations against managed or custom rules, making it ideal for compliance auditing.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Question 5

A company stores database passwords for their RDS instances and API keys for third-party services in their application code, which is a security risk. They want a managed service that securely stores these secrets, makes them available to applications via API, and automatically rotates database passwords. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a fully managed service specifically designed to securely store, retrieve, and automatically rotate secrets such as database passwords and API keys. It provides built-in integration with RDS for automatic rotation of database credentials without custom code, and it serves secrets via a secure API call, eliminating the need to hardcode secrets in application code.

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Answer

Amazon Cognito

Question 6

A company needs to allow inbound HTTPS traffic (port 443) to their EC2 web servers while blocking all other inbound traffic. The solution should be stateful — return traffic for allowed inbound connections should automatically be permitted without additional rules. Which AWS feature provides this?

Accepted Answer

Security groups. Security groups act as a stateful virtual firewall for EC2 instances. When you allow inbound HTTPS traffic on port 443, the security group automatically tracks the connection state and permits the corresponding outbound return traffic without requiring an explicit outbound rule. This stateful behavior is inherent to security groups and is the correct choice for the described requirement.

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF rules

Answer

VPC route tables

Question 7

A company manages 20 AWS accounts and wants employees to log in once with their corporate Active Directory credentials and then access any of their authorised AWS accounts without re-entering credentials for each account. Which AWS service provides this centralised single sign-on capability?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides centralized single sign-on (SSO) across multiple AWS accounts and business applications. It integrates with an external identity provider (IdP) such as Active Directory via SAML 2.0 or SCIM, allowing users to authenticate once with their corporate credentials and then access any authorized AWS account without re-entering credentials.

Answer

AWS Directory Service

Answer

Amazon Cognito

Answer

AWS Control Tower

Question 8

A security engineer needs to apply network traffic filtering rules at the subnet level rather than the instance level. The solution must be stateless and must explicitly define both inbound and outbound rules, including allowing return traffic. Which AWS feature provides subnet-level stateless traffic control?

Accepted Answer

Network Access Control Lists (NACLs). Network Access Control Lists (NACLs) are the correct choice because they operate at the subnet level, are stateless (meaning they do not automatically allow return traffic), and require explicit inbound and outbound rules. This matches the requirement for stateless traffic filtering where both directions must be defined separately, including rules for return traffic.

Answer

Security groups

Answer

AWS WAF

Answer

VPC route tables

Question 9

A company wants to set up a new multi-account AWS environment with pre-configured security guardrails, a logging account, an audit account, and a predefined structure for creating new accounts — all based on AWS best practices — with minimal manual configuration. Which AWS service provides this automated account setup?

Accepted Answer

AWS Control Tower. AWS Control Tower is the correct answer because it provides a fully automated, best-practices-based setup for a multi-account AWS environment, including pre-configured security guardrails (using Service Control Policies), a logging account, an audit account, and a predefined account structure via Account Factory. This eliminates the need for manual configuration of these foundational components.

Answer

AWS CloudFormation StackSets

Answer

AWS Organizations

Answer

AWS Security Hub

Question 10

A security team suspects unauthorised network traffic is reaching a subnet in their VPC. They need to capture metadata about the IP traffic (source IP, destination IP, port, protocol, accept/reject status) flowing through their VPC network interfaces for analysis. Which AWS feature provides this network traffic metadata?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing through VPC network interfaces, including source/destination IP addresses, ports, protocol numbers, and accept/reject status (based on security group and NACL rules). This is the correct service because it is specifically designed to log network traffic metadata at the VPC, subnet, or network interface level, enabling security analysis without impacting network performance.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS WAF logs

Question 11

A security team wants to automatically identify S3 buckets, IAM roles, and other resources in their AWS account that have policies granting access to external AWS accounts or the public internet — including findings they may not be aware of. Which AWS service performs this analysis?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it is specifically designed to analyze resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) and identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of your AWS account, including the public internet, even for resources you may not be aware of. This directly matches the security team's requirement to automatically identify such exposures.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Macie

Question 12

A company uses multiple AWS security services — GuardDuty, Inspector, Macie, and IAM Access Analyzer — across multiple accounts. The security team needs a single console to view, prioritise, and manage all security findings from these services and third-party tools. Which AWS service provides this aggregated view?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single, consolidated view of security alerts and compliance status across multiple AWS accounts and services, including GuardDuty, Inspector, Macie, and IAM Access Analyzer. It aggregates findings from these native services and third-party tools into a standardized format using the AWS Security Finding Format (ASFF), enabling centralized prioritization and management. This directly addresses the requirement for a unified console to view, prioritize, and manage all security findings.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Answer

AWS Config

Question 13

A development team is building a mobile application and needs to add user registration, sign-in, and authentication (including social login via Google and Facebook) without building and managing their own authentication backend. Which AWS service provides managed user authentication for applications?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it provides a fully managed user identity and authentication service specifically designed for mobile and web applications. It supports user registration, sign-in, and social login via identity providers like Google and Facebook through its user pools and identity pools features, eliminating the need to build and manage a custom authentication backend.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS SSO

Question 14

A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?

Accepted Answer

AWS Certificate Manager. AWS Certificate Manager (ACM) is the correct service because it is a managed service that provisions, renews, and deploys SSL/TLS certificates automatically at no additional cost when used with integrated AWS services like Application Load Balancers. ACM handles the entire certificate lifecycle, including automatic renewal before expiration, and integrates natively with ALB to enable HTTPS without manual intervention.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS IAM

Question 15

After GuardDuty generates a security finding about potentially compromised EC2 instances, a security analyst needs to investigate the full context of the threat — understanding which users, IPs, and resources were involved and how they relate to each other. Which AWS service helps investigators analyse and visualise these relationships?

Accepted Answer

Amazon Detective. Amazon Detective is designed specifically to analyze, investigate, and quickly identify the root cause of security findings by automatically collecting log data from AWS resources and building a graph model that shows relationships between users, IPs, and resources. When GuardDuty generates a finding about a potentially compromised EC2 instance, Detective can ingest that finding and provide a visual, interactive view of the entire resource interaction timeline, including network connections, API calls, and user activity, enabling investigators to understand the full context of the threat.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub