CLF-C02 Security and Compliance Practice Test 11 — 15 Questions

Question 1

A company wants all IAM users to verify their identity with both a password and a one-time code from an authenticator app before accessing the AWS Management Console. Which security control should the company enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multi-Factor Authentication (MFA). Multi-Factor Authentication (MFA) is the correct security control because it requires users to present two independent factors: something they know (password) and something they have (a one-time code from an authenticator app). This satisfies the company's requirement for both a password and a one-time code before accessing the AWS Management Console, significantly reducing the risk of unauthorized access even if a password is compromised.

Answer

AWS Shield

Answer

AWS WAF

Answer

Amazon Cognito

Question 2

A company's public-facing web application is being attacked with SQL injection and cross-site scripting (XSS) attempts. Which AWS service should they deploy to detect and block these web application attacks?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It allows you to create custom rules to filter and monitor HTTP(S) requests based on conditions such as IP addresses, HTTP headers, or request body patterns, and can block malicious traffic before it reaches your application.

Answer

AWS Shield Standard

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 3

A company is concerned about Distributed Denial of Service (DDoS) attacks against their website hosted on AWS. They want basic DDoS protection without incurring additional cost. Which AWS service provides automatic DDoS protection at no extra charge?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides basic protection against common infrastructure-layer DDoS attacks, such as SYN/UDP floods and reflection attacks. This matches the requirement for automatic, no-cost DDoS protection without any manual configuration or subscription.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Question 4

A security team wants to automatically detect unusual activity in their AWS account, such as EC2 instances communicating with known malicious IP addresses, unusual API calls indicating credential compromise, or cryptocurrency mining activity. Which AWS service uses machine learning to detect these threats?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious or unauthorized behavior in AWS accounts and workloads. It specifically analyzes VPC Flow Logs, AWS CloudTrail management and data events, and DNS logs to detect patterns such as EC2 instances communicating with known malicious IP addresses, unusual API calls indicative of credential compromise, and cryptocurrency mining activity. This makes it the correct choice for the described use case.

Answer

Amazon Inspector

Answer

AWS Security Hub

Answer

Amazon Macie

Question 5

A healthcare company stores patient records in Amazon S3 buckets across multiple accounts and needs to automatically discover and classify any objects containing personally identifiable information (PII) or protected health information (PHI). Which AWS service provides this capability?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It is specifically designed to identify personally identifiable information (PII) and protected health information (PHI) by analyzing object metadata and content, making it the correct choice for this healthcare compliance use case.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 6

A company encrypts data stored in Amazon S3, Amazon RDS, and Amazon EBS. The security team needs a managed service to create, rotate, and control the encryption keys used to protect this data, with full audit trails of key usage. Which AWS service should they use?

Accepted Answer

AWS KMS. AWS KMS is a managed service that allows you to create, rotate, and control encryption keys used to protect data in Amazon S3, Amazon RDS, and Amazon EBS. It integrates with AWS CloudTrail to provide full audit trails of key usage, meeting the security team's requirements for a managed key management solution.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Question 7

A compliance officer needs to download AWS's SOC 2 Type II report and ISO 27001 certification to provide to their company's auditors as evidence that the AWS infrastructure meets regulatory standards. Where should they access these documents?

Accepted Answer

AWS Artifact. AWS Artifact is the central resource for downloading AWS compliance reports, including SOC 2 Type II reports and ISO 27001 certifications. It provides on-demand access to these documents, which auditors require as evidence of AWS's adherence to regulatory standards. This service is specifically designed for compliance and audit use cases, making it the correct choice.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS Config

Question 8

A security team wants to automatically scan their Amazon EC2 instances for known software vulnerabilities (CVEs) and assess whether any instances have unintended network access paths open. Which AWS service performs these automated security assessments?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is specifically designed to perform automated vulnerability scans (including CVEs) and network reachability assessments on EC2 instances. It uses a combination of AWS security best practices and common vulnerability databases to identify software vulnerabilities and unintended network access paths, such as open ports or overly permissive security groups.

Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS Shield

Question 9

A developer needs to read objects from a specific Amazon S3 bucket. Following AWS security best practices, which approach should be used when creating the IAM policy for this developer?

Accepted Answer

Grant only s3:GetObject permission on the specific bucket. The principle of least privilege dictates granting only the specific permissions required for the task. By attaching an IAM policy with only the s3:GetObject action on the specific bucket ARN, the developer can read objects without having unnecessary permissions that could lead to accidental or malicious changes. This approach aligns with AWS security best practices for IAM policies.

Answer

Grant AdministratorAccess to ensure all required permissions are included

Answer

Grant AmazonS3FullAccess to cover all S3 operations

Answer

Use the root account credentials since they guarantee access

Question 10

A compliance team needs to track the configuration history of AWS resources, determine when a security group was last modified, and verify that all EC2 instances comply with a rule requiring encryption on all attached EBS volumes. Which AWS service provides these capabilities?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides configuration history of AWS resources, tracks changes to security groups (including last modification time), and allows you to define rules—such as requiring encryption on all EBS volumes attached to EC2 instances—and evaluate resources against those rules. It records configuration changes as configuration items and can trigger evaluations against managed or custom rules, making it ideal for compliance auditing.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Question 11

A company stores database passwords for their RDS instances and API keys for third-party services in their application code, which is a security risk. They want a managed service that securely stores these secrets, makes them available to applications via API, and automatically rotates database passwords. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a fully managed service specifically designed to securely store, retrieve, and automatically rotate secrets such as database passwords and API keys. It provides built-in integration with RDS for automatic rotation of database credentials without custom code, and it serves secrets via a secure API call, eliminating the need to hardcode secrets in application code.

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Answer

Amazon Cognito

Question 12

A company needs to allow inbound HTTPS traffic (port 443) to their EC2 web servers while blocking all other inbound traffic. The solution should be stateful — return traffic for allowed inbound connections should automatically be permitted without additional rules. Which AWS feature provides this?

Accepted Answer

Security groups. Security groups act as a stateful virtual firewall for EC2 instances. When you allow inbound HTTPS traffic on port 443, the security group automatically tracks the connection state and permits the corresponding outbound return traffic without requiring an explicit outbound rule. This stateful behavior is inherent to security groups and is the correct choice for the described requirement.

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF rules

Answer

VPC route tables

Question 13

A company manages 20 AWS accounts and wants employees to log in once with their corporate Active Directory credentials and then access any of their authorised AWS accounts without re-entering credentials for each account. Which AWS service provides this centralised single sign-on capability?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides centralized single sign-on (SSO) across multiple AWS accounts and business applications. It integrates with an external identity provider (IdP) such as Active Directory via SAML 2.0 or SCIM, allowing users to authenticate once with their corporate credentials and then access any authorized AWS account without re-entering credentials.

Answer

AWS Directory Service

Answer

Amazon Cognito

Answer

AWS Control Tower

Question 14

A security engineer needs to apply network traffic filtering rules at the subnet level rather than the instance level. The solution must be stateless and must explicitly define both inbound and outbound rules, including allowing return traffic. Which AWS feature provides subnet-level stateless traffic control?

Accepted Answer

Network Access Control Lists (NACLs). Network Access Control Lists (NACLs) are the correct choice because they operate at the subnet level, are stateless (meaning they do not automatically allow return traffic), and require explicit inbound and outbound rules. This matches the requirement for stateless traffic filtering where both directions must be defined separately, including rules for return traffic.

Answer

Security groups

Answer

AWS WAF

Answer

VPC route tables

Question 15

A company wants to set up a new multi-account AWS environment with pre-configured security guardrails, a logging account, an audit account, and a predefined structure for creating new accounts — all based on AWS best practices — with minimal manual configuration. Which AWS service provides this automated account setup?

Accepted Answer

AWS Control Tower. AWS Control Tower is the correct answer because it provides a fully automated, best-practices-based setup for a multi-account AWS environment, including pre-configured security guardrails (using Service Control Policies), a logging account, an audit account, and a predefined account structure via Account Factory. This eliminates the need for manual configuration of these foundational components.

Answer

AWS CloudFormation StackSets

Answer

AWS Organizations

Answer

AWS Security Hub