CLF-C02 Security and Compliance Practice Test 13 — 15 Questions

Question 1

A company needs to ensure that all data transmitted between their on-premises servers and AWS is encrypted during transfer. Which AWS services provide encryption in transit? (Choose the most complete answer.)

Accepted Answer

AWS Site-to-Site VPN using IPsec encryption. AWS Site-to-Site VPN is the correct choice because it creates an encrypted tunnel between on-premises servers and AWS using IPsec (Internet Protocol Security) protocol suite. IPsec provides confidentiality, integrity, and authentication for all data packets traversing the public internet, ensuring encryption in transit as required by the question.

Answer

AWS Direct Connect with dedicated link guarantees

Answer

Amazon S3 SSE-S3 encryption

Answer

AWS KMS key rotation

Question 2

Which AWS service acts as a centralized firewall for traffic inspection between VPCs, between VPCs and on-premises networks, and for internet traffic?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides a centralized firewall to inspect and filter traffic across VPCs, between VPCs and on-premises networks (via AWS Transit Gateway or VPN/Direct Connect), and for internet-bound traffic. It supports stateful and stateless rules, intrusion prevention (IPS), and domain filtering, making it the correct choice for a unified traffic inspection solution.

Answer

Security Groups

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF

Question 3

Which AWS service provides hardware-based key management and cryptographic operations using FIPS 140-2 Level 3 validated hardware security modules (HSMs)?

Accepted Answer

AWS CloudHSM. AWS CloudHSM is the correct answer because it provides dedicated, single-tenant hardware security modules (HSMs) that are FIPS 140-2 Level 3 validated. This allows customers to perform cryptographic operations (e.g., key generation, signing, encryption) using hardware that meets the highest security level required for regulated workloads like PKI and financial services.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

Amazon Macie

Question 4

Which AWS service allows you to monitor API calls made in your AWS account, including who made the call, from which IP address, and when?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in your AWS account, capturing details such as the identity of the caller, the source IP address, and the timestamp of each API call. This makes it the correct choice for monitoring who made a call, from where, and when.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Config

Question 5

A company must maintain audit records of all user actions and configuration changes across their AWS accounts. Which AWS service should they enable to capture this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity and user actions across AWS accounts, providing a complete audit trail of all management and data plane operations. This includes who made changes, what actions were performed, and when they occurred, which is essential for maintaining audit records of user actions and configuration changes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 6

Which AWS service provides managed threat detection that analyzes VPC Flow Logs, AWS CloudTrail events, and DNS logs to identify malicious activity and unauthorized behavior?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior by analyzing VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as credential compromise, cryptocurrency mining, and API abuse without requiring additional security software or infrastructure.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A company needs to grant an EC2 instance permission to write to an S3 bucket. What is the most secure way to accomplish this?

Accepted Answer

Attach an IAM role with the appropriate S3 permissions to the EC2 instance. Option C is correct because attaching an IAM role to an EC2 instance allows the instance to securely obtain temporary credentials via the instance metadata service (IMDS). These credentials are automatically rotated by AWS, eliminating the need to hardcode or store long-term access keys. The role's policy grants only the necessary S3 write permissions, following the principle of least privilege.

Answer

Hardcode the IAM user access keys in the application code

Answer

Store IAM access keys in environment variables on the EC2 instance

Answer

Create an IAM user and configure the instance with its credentials

Question 8

A company recently migrated to AWS and needs to ensure their S3 buckets are not publicly accessible. Which combination of controls best prevents accidental public S3 exposure?

Accepted Answer

Enable S3 Block Public Access at the account level and use AWS Config to detect violations. Option B is correct because S3 Block Public Access at the account level provides a centralized, enforceable guardrail that prevents any bucket or object from being made publicly accessible, overriding any bucket-level policies or ACLs. AWS Config can then continuously monitor for configuration violations, such as a bucket policy that grants public access, and trigger remediation or alerts. Together, these controls create a defense-in-depth approach that both prevents accidental exposure and detects non-compliance.

Answer

Enable S3 server-side encryption on all buckets

Answer

Enable S3 versioning on all buckets

Answer

Enable S3 Transfer Acceleration for all buckets

Question 9

A company wants to ensure that their AWS account root user is protected with the highest level of security. Which two actions should they take? (Choose the answer that covers both.)

Accepted Answer

Enable MFA on the root account and delete any existing root access keys. Option B is correct because enabling multi-factor authentication (MFA) on the AWS root user adds a second layer of security beyond the password, and deleting any existing root access keys eliminates the risk of programmatic access using long-term credentials. The root user has unrestricted access to all AWS resources, so these two actions are the most effective ways to protect it according to AWS best practices.

Answer

Create IAM user access keys for the root account to enable programmatic access

Answer

Use the root account for all day-to-day AWS operations to avoid delegation complexity

Question 10

A company is deploying an application that processes payment card data. Which AWS compliance program provides assurance that AWS infrastructure meets Payment Card Industry Data Security Standard requirements?

Accepted Answer

PCI DSS Level 1 compliance. PCI DSS Level 1 compliance is the highest level of validation for organizations that process payment card data, and AWS has been validated as a Level 1 service provider. This means AWS infrastructure has undergone the required on-site assessments and annual audits to meet the Payment Card Industry Data Security Standard (PCI DSS) requirements, providing assurance for the company's deployment.

Answer

SOC 2 Type II

Answer

HIPAA compliance

Answer

ISO 27001 certification

Question 11

Which AWS service provides a centrally managed firewall policy that can be applied to multiple AWS accounts and VPCs across an organization?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides a centralized firewall policy management across multiple accounts and VPCs within an AWS Organization. It allows you to deploy AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules consistently across your entire organization, ensuring a uniform security posture without manual per-account configuration.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 12

Which AWS feature protects S3 buckets from having their versioned objects permanently deleted without multi-factor authentication approval?

Accepted Answer

S3 MFA Delete. S3 MFA Delete is the correct answer because it is the specific S3 versioning feature that requires multi-factor authentication (MFA) to permanently delete versioned objects or suspend versioning on a bucket. When enabled, any DeleteObject request that includes a version ID (permanent delete) or a PUT request to suspend versioning must include the x-amz-mfa header with a valid MFA code from a hardware or virtual MFA device. This prevents unauthorized or accidental permanent deletion of object versions, even by users with full S3 permissions.

Answer

S3 Block Public Access

Answer

S3 Object Lock

Answer

S3 Access Points

Question 13

A security audit found that an S3 bucket is publicly readable. Which IAM/S3 mechanism should be reviewed to identify what grants the public access?

Accepted Answer

Bucket policies and S3 Block Public Access settings. Bucket policies are resource-based policies that explicitly define who has access to an S3 bucket, including public access grants like `"Principal": "*"`. S3 Block Public Access settings act as an overarching security control that can override bucket policies to prevent public access. Reviewing both mechanisms together identifies exactly how public readability was granted and whether any block was misconfigured or absent.

Answer

IAM identity-based policies attached to the root user

Answer

AWS Organizations Service Control Policies

Answer

Amazon Macie classification rules

Question 14

A company stores sensitive financial data in Amazon S3. They need to ensure that even if an attacker gains access to the S3 service, they cannot read the data without a customer-controlled encryption key. Which S3 encryption method satisfies this requirement?

Accepted Answer

SSE-KMS with a customer-managed CMK. Option C is correct because SSE-KMS with a customer-managed CMK ensures that the encryption key is under the customer's exclusive control, not AWS. Even if an attacker gains access to the S3 service, they cannot decrypt the data without the customer-managed CMK, which is stored in AWS KMS and can be further protected with key policies, IAM policies, and optional key rotation. This satisfies the requirement that the attacker cannot read the data without a customer-controlled encryption key.

Answer

SSE-S3 (Amazon S3-managed keys)

Answer

SSE-KMS with an AWS managed CMK (aws/s3)

Answer

S3 Versioning with MFA Delete

Question 15

A company is required by their compliance framework to encrypt all data at rest and in transit. Which AWS service provides centralized key creation, management, rotation, and audit logging for encryption keys used across AWS services?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a fully managed service that provides centralized control over encryption keys, including creation, rotation, and audit logging via AWS CloudTrail. It integrates seamlessly with other AWS services (e.g., S3, EBS, RDS) to encrypt data at rest and supports TLS/SSL for data in transit, meeting compliance requirements for key lifecycle management.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

Amazon Macie