CLF-C02 Security and Compliance Practice Test 15 — 15 Questions

Question 1

A company wants to implement multi-factor authentication for all IAM users across their AWS Organization without requiring individual account administrators to configure MFA for each user. Which approach enables organization-wide MFA enforcement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an SCP that denies all actions unless MFA is authenticated. Service Control Policies (SCPs) can be applied at the root or organizational unit level to enforce a condition that denies all AWS API actions unless the request includes multi-factor authentication (MFA). This ensures that every IAM user across the entire AWS Organization must authenticate with MFA before performing any action, without requiring individual account administrators to configure MFA per user.

Answer

Enable MFA on the root account only

Answer

Configure IAM password policies to require MFA

Answer

Enable AWS Config rule to check MFA status

Question 2

An organization needs to sign a Business Associate Agreement (BAA) with AWS to run applications that process Protected Health Information (PHI) under HIPAA. Which statement about AWS and HIPAA is accurate?

Accepted Answer

AWS will sign a BAA for eligible services, and customers are responsible for configuring services to meet HIPAA requirements. AWS does not have a blanket HIPAA certification; instead, it provides a Business Associate Agreement (BAA) for specific services listed in its HIPAA Eligible Services Reference. Customers must sign a BAA with AWS and then configure those eligible services (e.g., enabling encryption, access controls, logging) to meet their own HIPAA compliance obligations. This shared responsibility model means AWS is responsible for the security of the cloud, while the customer is responsible for security in the cloud.

Answer

AWS is HIPAA certified, meaning all AWS services automatically comply with HIPAA

Answer

PHI cannot be stored in the cloud because cloud environments are inherently non-compliant with HIPAA

Answer

HIPAA compliance is automatic once a BAA is signed with AWS

Question 3

A security team needs to demonstrate to auditors that no AWS infrastructure has been modified between two audit periods. Which AWS service provides a continuous record of configuration changes with before-and-after state for all resources?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously records configuration changes to AWS resources and provides a detailed history of each change, including the before-and-after state. This allows the security team to demonstrate to auditors that no infrastructure modifications occurred between two audit periods by reviewing the configuration timeline and compliance snapshots.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Question 4

Which AWS IAM feature allows you to set the maximum permissions that IAM entities in an account can have, regardless of what their identity-based policies allow?

Accepted Answer

Permission Boundaries. Permission Boundaries are an AWS IAM feature that sets the maximum permissions an IAM entity (user or role) can have. They act as a guardrail, limiting the effective permissions to the intersection of the identity-based policy and the boundary, regardless of what the identity-based policy allows. This ensures that even if a policy grants broad access, the boundary caps it at a defined maximum.

Answer

IAM Conditions

Answer

Service Control Policies (SCPs)

Answer

Resource-based policies

Question 5

A company wants to identify all resources in their AWS account that are accessible from outside the account — such as S3 buckets with public access or IAM roles with external trust. Which AWS service provides this analysis?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer is the correct service because it analyzes resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) to identify resources shared with an external entity outside the AWS account. It uses a policy analysis engine that evaluates the principal, action, and condition elements to determine if a policy grants access to an external AWS account, an IAM user in another account, or a public principal (e.g., `"Principal": "*"`). This directly matches the requirement to find resources accessible from outside the account.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 6

A company's compliance framework requires that all AWS API calls must be logged and that log integrity must be validated. Which AWS service with which feature satisfies this requirement?

Accepted Answer

AWS CloudTrail with Log File Integrity Validation enabled. AWS CloudTrail Log File Integrity Validation uses industry-standard algorithms (SHA-256 hashing and digital signatures with SHA-256 with RSA) to ensure that CloudTrail log files have not been tampered with after delivery. This feature enables you to validate that log files were not modified, deleted, or changed without authorization, directly meeting the compliance requirement for logging all AWS API calls and validating log integrity.

Answer

Amazon CloudWatch Logs with metric filters

Answer

AWS Config with conformance packs

Answer

VPC Flow Logs stored in S3

Question 7

Which AWS IAM object should be used to grant permissions to an AWS service (like EC2 or Lambda) to access other AWS services on behalf of the application?

Accepted Answer

IAM Role. An IAM Role is the correct AWS identity to grant permissions to an AWS service (e.g., EC2, Lambda) because it provides temporary security credentials via AWS Security Token Service (STS). Unlike IAM Users, roles are designed to be assumed by trusted entities, including AWS services, enabling them to access other AWS resources on behalf of the application without long-lived access keys.

Answer

IAM User with access keys

Answer

IAM Group

Answer

IAM Policy

Question 8

A multi-national company needs to ensure their AWS resources in Europe comply with GDPR by keeping all data within EU regions. Which approach ensures data remains in Europe?

Accepted Answer

Deploy resources only in EU AWS Regions and use SCPs to prevent deployment outside EU. Deploying resources only in EU AWS Regions (such as eu-west-1, eu-central-1) combined with Service Control Policies (SCPs) that explicitly deny actions outside those regions ensures data residency. SCPs are organization-level policies in AWS Organizations that can restrict member accounts from launching resources in non-EU regions, providing a preventive control to enforce GDPR data localization requirements.

Answer

AWS automatically keeps EU customer data in EU regions without any configuration

Answer

Enable CloudTrail in all regions to monitor data movement

Answer

GDPR compliance requires using only AWS GovCloud Regions

Question 9

Which AWS service provides a managed way to create, control, and rotate encryption keys used to protect your data?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct answer because it is a fully managed service that allows you to create, control, and rotate encryption keys used to protect your data. KMS integrates with other AWS services to encrypt data at rest and provides centralized key management, including automatic annual rotation for customer-managed keys. It uses hardware security modules (HSMs) to protect key material, but the service itself handles the management and rotation lifecycle.

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 10

What is the purpose of AWS Shield Standard?

Accepted Answer

To protect AWS resources against common DDoS attacks. AWS Shield Standard is a free, always-on service that protects all AWS customers from common, infrastructure-layer Distributed Denial of Service (DDoS) attacks, such as SYN floods, UDP floods, and reflection attacks. It uses network flow monitoring and inline mitigation techniques at the AWS edge to automatically detect and block malicious traffic targeting AWS resources like EC2, ELB, CloudFront, and Route 53. This makes option B correct because its sole purpose is to provide baseline DDoS protection without any additional configuration or cost.

Answer

To encrypt data at rest in S3 buckets

Answer

To monitor API calls made to AWS services

Answer

To filter malicious web traffic using rules

Question 11

A security team needs to continuously assess their AWS resources for security vulnerabilities and deviations from security best practices. Which service provides automated security assessments?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct answer because it provides a comprehensive view of your security posture across AWS accounts by aggregating, organizing, and prioritizing security findings from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Macie) and third-party tools. It continuously assesses your environment against security standards and best practices (e.g., CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices) and generates automated security assessments and compliance checks. This directly matches the requirement for continuous, automated security assessments.

Answer

AWS Trusted Advisor

Answer

Amazon Detective

Answer

AWS Config

Question 12

Which AWS service provides centralized governance and compliance across multiple AWS accounts in an organization?

Accepted Answer

AWS Organizations. AWS Organizations is the correct service because it provides centralized governance and compliance across multiple AWS accounts by enabling you to create a hierarchy of accounts with Service Control Policies (SCPs) that centrally control permissions. SCPs allow you to enforce compliance rules, such as restricting the use of specific AWS services or regions, across all accounts in the organization without requiring individual account-level configuration.

Answer

AWS IAM

Answer

AWS Config

Answer

Amazon Macie

Question 13

What is the principle of least privilege in AWS IAM?

Accepted Answer

Granting users only the minimum permissions required to perform their tasks. The principle of least privilege in AWS IAM dictates that users, roles, and services should be granted only the minimum permissions necessary to perform their intended functions. This is implemented by creating fine-grained IAM policies that specify exactly which actions are allowed on which resources, reducing the attack surface and limiting the blast radius of a potential compromise. Option B correctly captures this core security concept.

Answer

Giving all users administrator access to simplify management

Answer

Allowing users to request additional permissions as needed

Answer

Restricting all access by default and never granting permissions

Question 14

Which AWS service helps detect unusual API activity and potential security threats by analyzing AWS CloudTrail, VPC Flow Logs, and DNS logs?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to identify malicious activity. It analyzes data sources including AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to detect unusual API calls, potentially compromised instances, and other security threats.

Answer

AWS Security Hub

Answer

Amazon Macie

Answer

AWS CloudTrail

Question 15

Drag and drop the steps to set up an S3 bucket with versioning and public access blocked in the correct order.

Accepted Answer

Create bucket, Enable versioning, Block all public access, Upload objects, Set lifecycle rules. Bucket creation comes first, then enabling versioning, blocking public access, uploading objects, and optionally setting lifecycle rules.

Answer

Create bucket, Upload objects, Enable versioning, Block all public access, Set lifecycle rules

Answer

Create bucket, Block all public access, Enable versioning, Upload objects, Set lifecycle rules

Answer

Upload objects, Create bucket, Enable versioning, Block all public access, Set lifecycle rules