CLF-C02 Security and Compliance Practice Test 13 — 15 Questions

Question 1

Which AWS service is used to centrally manage and enforce policies across multiple AWS accounts in an organization, such as restricting which AWS services member accounts can use?

Accepted Answer

AWS Organizations with Service Control Policies. AWS Organizations with Service Control Policies (SCPs) is the correct service because SCPs enable central governance of the maximum available permissions for all accounts within an organization. SCPs act as a permission guardrail, allowing administrators to restrict which AWS services, actions, and resources member accounts can use, regardless of the IAM policies attached to those accounts. This makes SCPs the appropriate tool for enforcing organization-wide restrictions across multiple accounts.

Answer

AWS IAM policies

Answer

AWS Config rules

Answer

Amazon GuardDuty

Question 2

A security team needs to analyze VPC network traffic to detect anomalies and investigate security incidents. Which AWS service captures and stores network flow data for VPCs?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces within a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This data is stored in Amazon CloudWatch Logs or Amazon S3, enabling security teams to analyze traffic patterns, detect anomalies, and investigate incidents. AWS CloudTrail, Amazon Inspector, and Amazon GuardDuty serve different purposes—auditing API calls, assessing vulnerabilities, and threat detection, respectively—but do not directly capture raw network flow data.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 3

Which AWS service provides a Web Application Firewall that protects web applications from common exploits like SQL injection and cross-site scripting?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It allows you to create custom rules that block, allow, or monitor web requests based on conditions such as IP addresses, HTTP headers, URI strings, and request body content. This makes it the correct service for the described use case.

Answer

AWS Shield

Answer

Amazon GuardDuty

Answer

Security Groups

Question 4

A company needs to ensure that all data transmitted between their on-premises servers and AWS is encrypted during transfer. Which AWS services provide encryption in transit? (Choose the most complete answer.)

Accepted Answer

AWS Site-to-Site VPN using IPsec encryption. AWS Site-to-Site VPN is the correct choice because it creates an encrypted tunnel between on-premises servers and AWS using IPsec (Internet Protocol Security) protocol suite. IPsec provides confidentiality, integrity, and authentication for all data packets traversing the public internet, ensuring encryption in transit as required by the question.

Answer

AWS Direct Connect with dedicated link guarantees

Answer

Amazon S3 SSE-S3 encryption

Answer

AWS KMS key rotation

Question 5

Which AWS service acts as a centralized firewall for traffic inspection between VPCs, between VPCs and on-premises networks, and for internet traffic?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides a centralized firewall to inspect and filter traffic across VPCs, between VPCs and on-premises networks (via AWS Transit Gateway or VPN/Direct Connect), and for internet-bound traffic. It supports stateful and stateless rules, intrusion prevention (IPS), and domain filtering, making it the correct choice for a unified traffic inspection solution.

Answer

Security Groups

Answer

Network Access Control Lists (NACLs)

Answer

AWS WAF

Question 6

Which AWS service provides hardware-based key management and cryptographic operations using FIPS 140-2 Level 3 validated hardware security modules (HSMs)?

Accepted Answer

AWS CloudHSM. AWS CloudHSM is the correct answer because it provides dedicated, single-tenant hardware security modules (HSMs) that are FIPS 140-2 Level 3 validated. This allows customers to perform cryptographic operations (e.g., key generation, signing, encryption) using hardware that meets the highest security level required for regulated workloads like PKI and financial services.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

Amazon Macie

Question 7

Which AWS service allows you to monitor API calls made in your AWS account, including who made the call, from which IP address, and when?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in your AWS account, capturing details such as the identity of the caller, the source IP address, and the timestamp of each API call. This makes it the correct choice for monitoring who made a call, from where, and when.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Config

Question 8

A company must maintain audit records of all user actions and configuration changes across their AWS accounts. Which AWS service should they enable to capture this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity and user actions across AWS accounts, providing a complete audit trail of all management and data plane operations. This includes who made changes, what actions were performed, and when they occurred, which is essential for maintaining audit records of user actions and configuration changes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 9

Which AWS service provides managed threat detection that analyzes VPC Flow Logs, AWS CloudTrail events, and DNS logs to identify malicious activity and unauthorized behavior?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior by analyzing VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as credential compromise, cryptocurrency mining, and API abuse without requiring additional security software or infrastructure.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Config

Question 10

A company needs to grant an EC2 instance permission to write to an S3 bucket. What is the most secure way to accomplish this?

Accepted Answer

Attach an IAM role with the appropriate S3 permissions to the EC2 instance. Attaching an IAM role to an EC2 instance allows the instance to securely obtain temporary credentials via the instance metadata service (IMDS). These credentials are automatically rotated by AWS, eliminating the need to hardcode or store long-term access keys. The role's policy grants only the necessary S3 write permissions, following the principle of least privilege.

Answer

Hardcode the IAM user access keys in the application code

Answer

Store IAM access keys in environment variables on the EC2 instance

Answer

Create an IAM user and configure the instance with its credentials

Question 11

A company recently migrated to AWS and needs to ensure their S3 buckets are not publicly accessible. Which combination of controls best prevents accidental public S3 exposure?

Accepted Answer

Enable S3 Block Public Access at the account level and use AWS Config to detect violations. S3 Block Public Access at the account level provides a centralized, enforceable guardrail that prevents any bucket or object from being made publicly accessible, overriding any bucket-level policies or ACLs. AWS Config can then continuously monitor for configuration violations, such as a bucket policy that grants public access, and trigger remediation or alerts. Together, these controls create a defense-in-depth approach that both prevents accidental exposure and detects non-compliance.

Answer

Enable S3 server-side encryption on all buckets

Answer

Enable S3 versioning on all buckets

Answer

Enable S3 Transfer Acceleration for all buckets

Question 12

A company wants to ensure that their AWS account root user is protected with the highest level of security. Which two actions should they take? (Choose the answer that covers both.)

Accepted Answer

Enable MFA on the root account and delete any existing root access keys. To protect the AWS account root user with the highest level of security, you should enable MFA on the root account and delete any existing root access keys (Option B). This prevents unauthorized access using stolen credentials and eliminates the risk of long-term programmatic access. Sharing the root password (Option C) is a security anti-pattern because it increases the attack surface and violates the principle of least privilege. Instead, use IAM roles and users for day-to-day operations. Therefore, only Option B is a recommended best practice. Note that the question asks for two actions, but based on the options provided, only Option B is correct; Option C is incorrect.

Answer

Create IAM user access keys for the root account to enable programmatic access

Answer

Share the root password with the security team for emergency access

Answer

Use the root account for all day-to-day AWS operations to avoid delegation complexity

Question 13

A company is deploying an application that processes payment card data. Which AWS compliance program provides assurance that AWS infrastructure meets Payment Card Industry Data Security Standard requirements?

Accepted Answer

PCI DSS Level 1 compliance. PCI DSS Level 1 compliance is the highest level of validation for organizations that process payment card data, and AWS has been validated as a Level 1 service provider. This means AWS infrastructure has undergone the required on-site assessments and annual audits to meet the Payment Card Industry Data Security Standard (PCI DSS) requirements, providing assurance for the company's deployment.

Answer

SOC 2 Type II

Answer

HIPAA compliance

Answer

ISO 27001 certification

Question 14

Which AWS service provides a centrally managed firewall policy that can be applied to multiple AWS accounts and VPCs across an organization?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides a centralized firewall policy management across multiple accounts and VPCs within an AWS Organization. It allows you to deploy AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules consistently across your entire organization, ensuring a uniform security posture without manual per-account configuration.

Answer

AWS WAF

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 15

Which AWS feature protects S3 buckets from having their versioned objects permanently deleted without multi-factor authentication approval?

Accepted Answer

S3 MFA Delete. S3 MFA Delete is the correct answer because it is the specific S3 versioning feature that requires multi-factor authentication (MFA) to permanently delete versioned objects or suspend versioning on a bucket. When enabled, any DeleteObject request that includes a version ID (permanent delete) or a PUT request to suspend versioning must include the x-amz-mfa header with a valid MFA code from a hardware or virtual MFA device. This prevents unauthorized or accidental permanent deletion of object versions, even by users with full S3 permissions.

Answer

S3 Block Public Access

Answer

S3 Object Lock

Answer

S3 Access Points