CLF-C02 Security and Compliance Practice Test 14 — 15 Questions

Question 1

A security audit found that an S3 bucket is publicly readable. Which IAM/S3 mechanism should be reviewed to identify what grants the public access?

Accepted Answer

Bucket policies and S3 Block Public Access settings. Bucket policies are resource-based policies that explicitly define who has access to an S3 bucket, including public access grants like `"Principal": "*"`. S3 Block Public Access settings act as an overarching security control that can override bucket policies to prevent public access. Reviewing both mechanisms together identifies exactly how public readability was granted and whether any block was misconfigured or absent.

Answer

IAM identity-based policies attached to the root user

Answer

AWS Organizations Service Control Policies

Answer

Amazon Macie classification rules

Question 2

A company stores sensitive financial data in Amazon S3. They need to ensure that even if an attacker gains access to the S3 service, they cannot read the data without a customer-controlled encryption key. Which S3 encryption method satisfies this requirement?

Accepted Answer

SSE-KMS with a customer-managed CMK. SSE-KMS with a customer-managed CMK ensures that the encryption key is under the customer's exclusive control, not AWS. Even if an attacker gains access to the S3 service, they cannot decrypt the data without the customer-managed CMK, which is stored in AWS KMS and can be further protected with key policies, IAM policies, and optional key rotation. This satisfies the requirement that the attacker cannot read the data without a customer-controlled encryption key.

Answer

SSE-S3 (Amazon S3-managed keys)

Answer

SSE-KMS with an AWS managed CMK (aws/s3)

Answer

S3 Versioning with MFA Delete

Question 3

A company is required by their compliance framework to encrypt all data at rest and in transit. Which AWS service provides centralized key creation, management, rotation, and audit logging for encryption keys used across AWS services?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a fully managed service that provides centralized control over encryption keys, including creation, rotation, and audit logging via AWS CloudTrail. It integrates seamlessly with other AWS services (e.g., S3, EBS, RDS) to encrypt data at rest and supports TLS/SSL for data in transit, meeting compliance requirements for key lifecycle management.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

Amazon Macie

Question 4

A company needs to ensure that none of their AWS accounts allow resources to be deployed outside of the us-east-1 and eu-west-1 regions for data sovereignty. Which control achieves this most effectively?

Accepted Answer

Apply an SCP in AWS Organizations that denies resource creation outside approved regions. B is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny resource creation in non-approved regions across all member accounts. By applying an SCP with a condition that denies actions unless the `aws:RequestedRegion` is `us-east-1` or `eu-west-1`, you enforce data sovereignty at the organization level, preventing any account from deploying resources outside those regions regardless of individual account permissions.

Answer

Configure AWS Config rules in each account to detect out-of-region deployments

Answer

Train developers to only deploy in approved regions

Answer

Enable IAM permission boundaries restricting regions in each account

Question 5

Which AWS service provides automated security assessments of EC2 instances against a library of security best practices and common vulnerabilities?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct AWS service because it is specifically designed to perform automated security assessments of EC2 instances. It uses a library of rules mapped to common security best practices (e.g., CIS benchmarks) and common vulnerabilities (e.g., CVEs) to scan the instance's OS and network configuration, generating a detailed findings report.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Answer

AWS Config

Question 6

A company's compliance team needs to know which AWS resources are not compliant with the company's tagging policy (all resources must have a 'CostCenter' tag). Which AWS service can continuously evaluate and report on this compliance?

Accepted Answer

AWS Config with the required-tags rule. AWS Config with the managed 'required-tags' rule can continuously evaluate whether resources have the specified tag (e.g., 'CostCenter') and report non-compliant resources. AWS Config records configuration changes, evaluates them against rules, and provides a compliance dashboard and notifications via Amazon SNS, making it the correct service for ongoing compliance monitoring.

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 7

According to the AWS Shared Responsibility Model, for which of the following is the customer ALWAYS responsible, regardless of the AWS service used?

Accepted Answer

Customer data and its classification. Under the AWS Shared Responsibility Model, the customer is always responsible for customer data and its classification, regardless of the service used. This includes deciding what data to store, how it is encrypted, and how access controls are configured. AWS never assumes responsibility for the content or classification of customer data, as this is entirely under the customer's control.

Answer

Physical security of the data center

Answer

Patching the underlying hypervisor

Answer

Network infrastructure management

Question 8

A company's security team wants to automatically remediate non-compliant AWS Config rules, such as automatically enabling S3 server-side encryption on any bucket found without it. Which AWS Config feature enables this?

Accepted Answer

AWS Config Rules with Automatic Remediation using SSM Automation. AWS Config Rules with Automatic Remediation using SSM Automation (Option B) is the correct feature because it allows you to associate an SSM Automation document with a non-compliant AWS Config rule. When a resource is evaluated as non-compliant, Config can automatically invoke the SSM Automation runbook to remediate the issue—for example, enabling S3 server-side encryption on a bucket that lacks it. This directly satisfies the security team's requirement for automated, policy-driven remediation without manual intervention.

Answer

AWS Config rule compliance reporting only

Answer

AWS Security Hub findings export to S3

Answer

Amazon GuardDuty threat response

Question 9

A company is setting up their AWS account for the first time. What security action should they take immediately after creating the account?

Accepted Answer

Enable MFA on the root account and create an IAM admin user for daily operations. The root user has unrestricted access to the AWS account, and enabling Multi-Factor Authentication (MFA) on the root account adds a critical second layer of security to prevent unauthorized access. Creating an IAM admin user for daily operations follows the principle of least privilege, ensuring that routine administrative tasks are performed using IAM roles or users with controlled permissions, rather than the highly privileged root user. This is a foundational security best practice recommended by AWS immediately after account creation.

Answer

Create IAM users for all employees immediately

Answer

Create root access keys for programmatic access

Answer

Enable AWS Config in all regions

Question 10

Which AWS service provides a finding-based security recommendations service that uses AI to identify security threats and anomalies, going beyond simple rule-based Config checks?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a security monitoring service that uses machine learning to analyze AWS logs (CloudTrail, VPC Flow Logs, DNS) and identifies threats, anomalies, and suspicious behavior. It provides findings and security recommendations, going beyond simple rule-based checks like AWS Config by using AI to detect patterns indicative of security issues. Amazon DevOps Guru focuses on operational health, not security, so it does not match the 'security recommendations' description.

Answer

AWS Config

Answer

Amazon DevOps Guru

Answer

Amazon Inspector

Question 11

A company's security policy requires that access keys for IAM users must be rotated every 90 days. Which AWS service can automatically detect users with non-compliant key age?

Accepted Answer

AWS Config with the access-keys-rotated rule. AWS Config with the 'access-keys-rotated' managed rule automatically checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a key exceeds the configured maximum age, AWS Config flags the resource as non-compliant, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 12

Which AWS networking feature prevents resources in a private subnet from directly receiving inbound connections from the internet, while still allowing them to initiate outbound connections?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It achieves this by translating the private IP of the instance to the NAT Gateway's Elastic IP for outbound traffic, and only forwarding return traffic that matches an established outbound session.

Answer

Internet Gateway

Answer

Security Groups

Answer

Network ACLs

Question 13

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

Accepted Answer

A customer configuring security groups to restrict unnecessary inbound traffic to EC2 instances. Configuring security groups to restrict inbound traffic is a customer responsibility under the Shared Responsibility Model. Security groups act as a virtual firewall for EC2 instances, and customers must define rules to control traffic at the instance level. AWS manages the underlying network infrastructure but does not configure customer-specific access controls.

Answer

AWS ensuring the physical data center is protected from unauthorized entry

Answer

AWS patching the underlying hypervisor on EC2 hosts

Answer

AWS ensuring S3 storage hardware is replaced when it fails

Question 14

A company wants to implement zero-trust network security for their AWS environment. Which AWS service enables access to EC2 instances without requiring open inbound network ports or bastion hosts?

Accepted Answer

AWS Systems Manager Session Manager. AWS Systems Manager Session Manager provides secure, auditable shell access to EC2 instances without requiring open inbound ports (e.g., SSH port 22 or RDP port 3389) or a bastion host. It uses the AWS Systems Manager agent to initiate a session via the AWS API, leveraging IAM policies for authentication and authorization, and can optionally encrypt session data using AWS KMS.

Answer

AWS Bastion Host on EC2

Answer

AWS Direct Connect

Answer

Amazon VPC Endpoints

Question 15

A company needs to store their application's database connection strings and automatically rotate them every 30 days. Which AWS service handles secret storage with automatic rotation built in?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is specifically designed to securely store secrets such as database connection strings, API keys, and passwords, and it provides built-in automatic rotation of secrets at a configurable interval (e.g., every 30 days) using AWS Lambda. This eliminates the need for custom rotation logic and integrates natively with supported databases like Amazon RDS, Redshift, and DocumentDB.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with encryption

Answer

AWS KMS