CLF-C02 Security and Compliance Practice Test 14 — 15 Questions

Question 1

A company needs to ensure that none of their AWS accounts allow resources to be deployed outside of the us-east-1 and eu-west-1 regions for data sovereignty. Which control achieves this most effectively?

Accepted Answer

Apply an SCP in AWS Organizations that denies resource creation outside approved regions. B is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny resource creation in non-approved regions across all member accounts. By applying an SCP with a condition that denies actions unless the `aws:RequestedRegion` is `us-east-1` or `eu-west-1`, you enforce data sovereignty at the organization level, preventing any account from deploying resources outside those regions regardless of individual account permissions.

Answer

Configure AWS Config rules in each account to detect out-of-region deployments

Answer

Train developers to only deploy in approved regions

Answer

Enable IAM permission boundaries restricting regions in each account

Question 2

Which AWS service provides automated security assessments of EC2 instances against a library of security best practices and common vulnerabilities?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct AWS service because it is specifically designed to perform automated security assessments of EC2 instances. It uses a library of rules mapped to common security best practices (e.g., CIS benchmarks) and common vulnerabilities (e.g., CVEs) to scan the instance's OS and network configuration, generating a detailed findings report.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS Config

Question 3

A company's compliance team needs to know which AWS resources are not compliant with the company's tagging policy (all resources must have a 'CostCenter' tag). Which AWS service can continuously evaluate and report on this compliance?

Accepted Answer

AWS Config with the required-tags rule. AWS Config with the managed 'required-tags' rule can continuously evaluate whether resources have the specified tag (e.g., 'CostCenter') and report non-compliant resources. AWS Config records configuration changes, evaluates them against rules, and provides a compliance dashboard and notifications via Amazon SNS, making it the correct service for ongoing compliance monitoring.

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 4

According to the AWS Shared Responsibility Model, for which of the following is the customer ALWAYS responsible, regardless of the AWS service used?

Accepted Answer

Customer data and its classification. Under the AWS Shared Responsibility Model, the customer is always responsible for customer data and its classification, regardless of the service used. This includes deciding what data to store, how it is encrypted, and how access controls are configured. AWS never assumes responsibility for the content or classification of customer data, as this is entirely under the customer's control.

Answer

Physical security of the data center

Answer

Patching the underlying hypervisor

Answer

Network infrastructure management

Question 5

A company's security team wants to automatically remediate non-compliant AWS Config rules, such as automatically enabling S3 server-side encryption on any bucket found without it. Which AWS Config feature enables this?

Accepted Answer

AWS Config Rules with Automatic Remediation using SSM Automation. AWS Config Rules with Automatic Remediation using SSM Automation (Option B) is the correct feature because it allows you to associate an SSM Automation document with a non-compliant AWS Config rule. When a resource is evaluated as non-compliant, Config can automatically invoke the SSM Automation runbook to remediate the issue—for example, enabling S3 server-side encryption on a bucket that lacks it. This directly satisfies the security team's requirement for automated, policy-driven remediation without manual intervention.

Answer

AWS Config rule compliance reporting only

Answer

AWS Security Hub findings export to S3

Answer

Amazon GuardDuty threat response

Question 6

A company wants to protect their S3 buckets from accidental or malicious data exfiltration by ensuring that data can only leave the VPC through S3 endpoint conditions. Which IAM policy condition controls this?

Accepted Answer

VPC endpoint policy with aws:SourceVpc condition. Option B is correct because the `aws:SourceVpc` condition key in a VPC endpoint policy restricts access to S3 buckets so that requests must originate from the specified VPC. This ensures that data can only leave the VPC through the S3 VPC endpoint, preventing accidental or malicious data exfiltration via the public internet. By combining this condition with a VPC endpoint policy, the company enforces network-level control over S3 access.

Answer

S3 Block Public Access

Answer

S3 CORS configuration

Answer

Amazon Macie sensitive data classification

Question 7

A company is setting up their AWS account for the first time. What security action should they take immediately after creating the account?

Accepted Answer

Enable MFA on the root account and create an IAM admin user for daily operations. Option B is correct because the root user has unrestricted access to the AWS account, and enabling Multi-Factor Authentication (MFA) on the root account adds a critical second layer of security to prevent unauthorized access. Creating an IAM admin user for daily operations follows the principle of least privilege, ensuring that routine administrative tasks are performed using IAM roles or users with controlled permissions, rather than the highly privileged root user. This is a foundational security best practice recommended by AWS immediately after account creation.

Answer

Create IAM users for all employees immediately

Answer

Create root access keys for programmatic access

Answer

Enable AWS Config in all regions

Question 8

Which AWS service provides a finding-based security recommendations service that uses AI to identify operational issues and anomalies, going beyond simple rule-based Config checks?

Accepted Answer

Amazon DevOps Guru. Amazon DevOps Guru is the correct answer because it is an ML-powered service that automatically detects operational issues and anomalies, such as anomalous application behavior or resource contention, and provides finding-based security recommendations. Unlike rule-based services, DevOps Guru analyzes historical and real-time metrics, logs, and events to identify patterns that deviate from normal behavior, going beyond simple compliance checks.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 9

A company's security policy requires that access keys for IAM users must be rotated every 90 days. Which AWS service can automatically detect users with non-compliant key age?

Accepted Answer

AWS Config with the access-keys-rotated rule. AWS Config with the 'access-keys-rotated' managed rule automatically checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a key exceeds the configured maximum age, AWS Config flags the resource as non-compliant, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 10

Which AWS networking feature prevents resources in a private subnet from directly receiving inbound connections from the internet, while still allowing them to initiate outbound connections?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It achieves this by translating the private IP of the instance to the NAT Gateway's Elastic IP for outbound traffic, and only forwarding return traffic that matches an established outbound session.

Answer

Internet Gateway

Answer

Security Groups

Answer

Network ACLs

Question 11

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

Accepted Answer

A customer configuring security groups to restrict unnecessary inbound traffic to EC2 instances. Option B is correct because configuring security groups to restrict inbound traffic is a customer responsibility under the Shared Responsibility Model. Security groups act as a virtual firewall for EC2 instances, and customers must define rules to control traffic at the instance level. AWS manages the underlying network infrastructure but does not configure customer-specific access controls.

Answer

AWS ensuring the physical data center is protected from unauthorized entry

Answer

AWS patching the underlying hypervisor on EC2 hosts

Answer

AWS ensuring S3 storage hardware is replaced when it fails

Question 12

A company wants to implement zero-trust network security for their AWS environment. Which AWS service enables access to EC2 instances without requiring open inbound network ports or bastion hosts?

Accepted Answer

AWS Systems Manager Session Manager. AWS Systems Manager Session Manager provides secure, auditable shell access to EC2 instances without requiring open inbound ports (e.g., SSH port 22 or RDP port 3389) or a bastion host. It uses the AWS Systems Manager agent to initiate a session via the AWS API, leveraging IAM policies for authentication and authorization, and can optionally encrypt session data using AWS KMS.

Answer

AWS Bastion Host on EC2

Answer

AWS Direct Connect

Answer

Amazon VPC Endpoints

Question 13

Which AWS service automatically generates password policies, reviews IAM users, and provides a security score to help assess the security posture of an AWS account?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor is the correct service because it provides automated checks that include password policy recommendations (e.g., minimum length, expiration), IAM user reviews (e.g., unused keys, MFA status), and a security score that aggregates findings to assess overall account security posture. This directly matches the question's description of generating password policies, reviewing IAM users, and providing a security score.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

Amazon Macie

Question 14

A company needs to store their application's database connection strings and automatically rotate them every 30 days. Which AWS service handles secret storage with automatic rotation built in?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is specifically designed to securely store secrets such as database connection strings, API keys, and passwords, and it provides built-in automatic rotation of secrets at a configurable interval (e.g., every 30 days) using AWS Lambda. This eliminates the need for custom rotation logic and integrates natively with supported databases like Amazon RDS, Redshift, and DocumentDB.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with encryption

Answer

AWS KMS

Question 15

A company wants to implement multi-factor authentication for all IAM users across their AWS Organization without requiring individual account administrators to configure MFA for each user. Which approach enables organization-wide MFA enforcement?

Accepted Answer

Apply an SCP that denies all actions unless MFA is authenticated. Option B is correct because Service Control Policies (SCPs) can be applied at the root or organizational unit level to enforce a condition that denies all AWS API actions unless the request includes multi-factor authentication (MFA). This ensures that every IAM user across the entire AWS Organization must authenticate with MFA before performing any action, without requiring individual account administrators to configure MFA per user.

Answer

Enable MFA on the root account only

Answer

Configure IAM password policies to require MFA

Answer

Enable AWS Config rule to check MFA status