CLF-C02 Security and Compliance Practice Test 12 — 15 Questions

Question 1

A security team suspects unauthorised network traffic is reaching a subnet in their VPC. They need to capture metadata about the IP traffic (source IP, destination IP, port, protocol, accept/reject status) flowing through their VPC network interfaces for analysis. Which AWS feature provides this network traffic metadata?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing through VPC network interfaces, including source/destination IP addresses, ports, protocol numbers, and accept/reject status (based on security group and NACL rules). This is the correct service because it is specifically designed to log network traffic metadata at the VPC, subnet, or network interface level, enabling security analysis without impacting network performance.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS WAF logs

Question 2

A security team wants to automatically identify S3 buckets, IAM roles, and other resources in their AWS account that have policies granting access to external AWS accounts or the public internet — including findings they may not be aware of. Which AWS service performs this analysis?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it is specifically designed to analyze resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) and identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of your AWS account, including the public internet, even for resources you may not be aware of. This directly matches the security team's requirement to automatically identify such exposures.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Macie

Question 3

A company uses multiple AWS security services — GuardDuty, Inspector, Macie, and IAM Access Analyzer — across multiple accounts. The security team needs a single console to view, prioritise, and manage all security findings from these services and third-party tools. Which AWS service provides this aggregated view?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single, consolidated view of security alerts and compliance status across multiple AWS accounts and services, including GuardDuty, Inspector, Macie, and IAM Access Analyzer. It aggregates findings from these native services and third-party tools into a standardized format using the AWS Security Finding Format (ASFF), enabling centralized prioritization and management. This directly addresses the requirement for a unified console to view, prioritize, and manage all security findings.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Answer

AWS Config

Question 4

A development team is building a mobile application and needs to add user registration, sign-in, and authentication (including social login via Google and Facebook) without building and managing their own authentication backend. Which AWS service provides managed user authentication for applications?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it provides a fully managed user identity and authentication service specifically designed for mobile and web applications. It supports user registration, sign-in, and social login via identity providers like Google and Facebook through its user pools and identity pools features, eliminating the need to build and manage a custom authentication backend.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS SSO

Question 5

A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?

Accepted Answer

AWS Certificate Manager. AWS Certificate Manager (ACM) is the correct service because it is a managed service that provisions, renews, and deploys SSL/TLS certificates automatically at no additional cost when used with integrated AWS services like Application Load Balancers. ACM handles the entire certificate lifecycle, including automatic renewal before expiration, and integrates natively with ALB to enable HTTPS without manual intervention.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS IAM

Question 6

After GuardDuty generates a security finding about potentially compromised EC2 instances, a security analyst needs to investigate the full context of the threat — understanding which users, IPs, and resources were involved and how they relate to each other. Which AWS service helps investigators analyse and visualise these relationships?

Accepted Answer

Amazon Detective. Amazon Detective is designed specifically to analyze, investigate, and quickly identify the root cause of security findings by automatically collecting log data from AWS resources and building a graph model that shows relationships between users, IPs, and resources. When GuardDuty generates a finding about a potentially compromised EC2 instance, Detective can ingest that finding and provide a visual, interactive view of the entire resource interaction timeline, including network connections, API calls, and user activity, enabling investigators to understand the full context of the threat.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 7

A company manages 15 AWS accounts and wants to centrally deploy and enforce consistent AWS WAF rules, security groups, and Shield Advanced protections across all accounts and regions from a single administrator account. Which AWS service provides this centralised security policy management?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides centralized security policy management across multiple AWS accounts and regions. It allows an administrator to define and enforce AWS WAF rules, security group rules, and Shield Advanced protections from a single administrator account, ensuring consistent compliance across all accounts in an AWS Organization.

Answer

AWS WAF

Answer

AWS Security Hub

Answer

AWS Shield Advanced

Question 8

A company discovered that an IAM user's access keys were accidentally committed to a public GitHub repository. Which immediate action should they take first?

Accepted Answer

Immediately deactivate or delete the exposed IAM access keys. The immediate priority when IAM access keys are exposed is to revoke their validity to prevent unauthorized use. Deactivating or deleting the keys ensures that any malicious actor who obtained them from the public repository can no longer authenticate as the IAM user, stopping potential data breaches or resource abuse. This aligns with the AWS security best practice of rotating credentials upon suspected compromise.

Answer

Delete the GitHub repository

Answer

Enable MFA for the IAM user

Answer

Move the credentials to a private repository

Question 9

Which AWS service continuously assesses your AWS resources for security vulnerabilities, unintended network exposure, and deviations from security best practices?

Accepted Answer

Amazon Inspector. Amazon Inspector is a vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It uses a combination of network reachability analysis and agent-based or agentless assessments to detect deviations from security best practices, such as missing patches or open ports to the internet.

Answer

AWS Security Hub

Answer

AWS Config

Answer

Amazon Macie

Question 10

A company must encrypt all data at rest stored in Amazon S3 and wants AWS to manage the encryption keys. Which S3 encryption option requires the least operational overhead?

Accepted Answer

SSE-S3 (Amazon S3-Managed Keys). SSE-S3 uses Amazon S3-managed keys, where AWS fully handles key creation, management, and rotation with no configuration required from the user. This option provides the least operational overhead because you simply enable server-side encryption on the bucket or object, and AWS manages the entire encryption process transparently.

Answer

SSE-C (Customer-Provided Keys)

Answer

SSE-KMS (AWS KMS-Managed Keys)

Answer

Client-side encryption

Question 11

Which AWS service provides a central place to manage security alerts and automate compliance checks across an AWS Organization?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a single, central location for aggregating, organizing, and prioritizing security alerts (findings) from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Macie) and third-party tools. It also enables automated compliance checks against standards such as CIS AWS Foundations, PCI DSS, and AWS Foundational Security Best Practices across all accounts in an AWS Organization, using built-in or custom controls.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 12

What does the principle of least privilege mean in the context of AWS IAM?

Accepted Answer

Grant only the minimum permissions necessary to perform required tasks. The principle of least privilege in AWS IAM means granting only the permissions that are strictly necessary for a user, role, or service to perform its intended functions. This minimizes the attack surface by ensuring that even if credentials are compromised, the potential damage is limited to only the allowed actions and resources. AWS IAM enforces this through fine-grained policy statements that specify exact actions, resources, and conditions.

Answer

All IAM users should have the same level of access to ensure consistency

Answer

Use AWS managed policies instead of customer-managed policies

Answer

Rotate IAM access keys every 90 days

Question 13

A company wants to identify sensitive data (such as PII and credit card numbers) stored in Amazon S3 buckets across their organization. Which AWS service automates this discovery?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data stored in Amazon S3. It automatically identifies personally identifiable information (PII), credit card numbers, and other sensitive data types, making it the correct choice for this use case.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 14

Which AWS service provides DDoS protection for all AWS customers at no additional charge and automatically protects resources at Layers 3 and 4?

Accepted Answer

AWS Shield Standard. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides always-on detection and inline mitigation of DDoS attacks targeting Layers 3 (network) and 4 (transport) of the OSI model. It protects common AWS resources such as Amazon CloudFront, Elastic Load Balancing, and Amazon Route 53 from common infrastructure-layer attacks like SYN floods and UDP reflection attacks.

Answer

AWS WAF

Answer

AWS Shield Advanced

Answer

Amazon CloudFront with geo-restriction

Question 15

A company needs to store database passwords and API keys used by their applications, with automatic rotation and audit logging of access. Which AWS service is purpose-built for this?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for securely storing, automatically rotating, and auditing access to database passwords, API keys, and other secrets. It natively supports automatic rotation with built-in integrations for Amazon RDS, Redshift, and DocumentDB, and it logs every secret access call in AWS CloudTrail for audit compliance.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

Amazon S3 with bucket policies