CLF-C02 Security and Compliance Practice Test 2 — 15 Questions

Question 1

A company hosts a web application behind an Application Load Balancer (ALB) in AWS. The application must comply with a security policy requiring TLS encryption for all traffic between users and the ALB. The company wants to automate the renewal of TLS certificates and avoid manual certificate management. Which AWS service should the company use to provision and automatically renew the certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it integrates directly with Application Load Balancers to provision and automatically renew TLS certificates, eliminating manual certificate management. ACM handles the entire certificate lifecycle, including renewal, which is essential for maintaining TLS encryption compliance without operational overhead.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 2

A company runs multiple workloads on AWS and must ensure that all Amazon S3 buckets have server-side encryption enabled. The compliance team wants to automatically detect any S3 bucket that is created without encryption and receive an alert. They also want to continuously monitor existing buckets for compliance. Which AWS service should they use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-server-side-encryption-enabled', which automatically checks whether each S3 bucket has server-side encryption enabled. When a non-compliant bucket is detected (either newly created or existing), AWS Config can trigger an Amazon SNS notification to alert the compliance team, meeting both the detection and alerting requirements.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 3

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?

Accepted Answer

AWS Organizations service control policies (SCPs). AWS Organizations service control policies (SCPs) allow a central administrator to define maximum permissions for all accounts within an organization. By creating an SCP that explicitly denies the `iam:CreateUser` action, the security team can enforce that no IAM users can be created in any member account, including future accounts, because SCPs are inherited by all accounts in the organization. This provides a single, centralized mechanism that cannot be overridden by account-level IAM policies.

Answer

AWS Identity and Access Management (IAM) policies

Answer

AWS Config managed rules with automatic remediation

Answer

IAM Access Analyzer

Question 4

A company stores sensitive documents in Amazon S3. The security team wants a preventive control that ensures no S3 bucket in the AWS account can ever be configured with a bucket policy that grants public read or write access. This control must apply automatically to all newly created buckets and to existing buckets, without requiring changes to individual bucket policies. Which AWS feature should the security team use?

Accepted Answer

Amazon S3 Block Public Access at the account level. Amazon S3 Block Public Access at the account level is a preventive control that, when enabled, overrides any bucket policies or ACLs that would grant public read or write access. It applies automatically to all existing and newly created buckets in the account without requiring changes to individual bucket policies. This meets the security team's requirement for a blanket, account-wide preventive control.

Answer

AWS Config with the s3-bucket-public-read-prohibited managed rule

Answer

AWS Identity and Access Management (IAM) policy with a condition that denies s3:PutBucketPolicy for any action that grants public access

Answer

Amazon GuardDuty with a finding suppression rule for S3 public access events

Question 5

A company uses AWS Organizations to manage multiple AWS accounts. The security team must ensure that all API activity across all accounts, including any new accounts added in the future, is recorded and delivered to a centralized S3 bucket for auditing. The solution should require minimal ongoing manual effort. Which AWS feature should the security team use?

Accepted Answer

Create an AWS CloudTrail organization trail that logs events for all accounts in the organization.. Option B is correct because AWS CloudTrail organization trails automatically log events for all accounts in an AWS Organization, including any new accounts added in the future, and deliver them to a single S3 bucket without requiring per-account configuration. This satisfies the requirement for minimal ongoing manual effort and centralized auditing.

Answer

Enable AWS CloudTrail in each account individually and configure the S3 bucket to allow cross-account access from the audit account.

Answer

Use AWS Config to record API calls and deliver configuration history to an S3 bucket.

Answer

Set up Amazon GuardDuty to monitor API activity and send findings to a centralized S3 bucket.

Question 6

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to enforce a policy that prevents any employee from deploying resources in AWS Regions outside of the United States. The company’s legal department requires a preventive control that automatically blocks all resource creation in non-approved Regions for every account, including any new accounts added in the future. The team wants a solution that requires minimal ongoing administration. Which AWS feature should the security team use?

Accepted Answer

Attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region.. Option C is correct because a Service Control Policy (SCP) attached to the root or an OU in AWS Organizations can deny all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region (e.g., `us-east-1` or `us-west-2`). This provides a preventive, account-wide guard that automatically applies to all existing and future accounts in the organization, requiring no per-user or per-role configuration and minimal ongoing administration.

Answer

Create an IAM policy with a condition that denies `ec2:RunInstances` if the Region is not `us-east-1` or `us-west-2`, and attach it to all IAM users and roles.

Answer

Configure an AWS Config rule that checks for resources in non-approved Regions and automatically terminates them using a custom Lambda function.

Answer

Use VPC endpoint policies to restrict traffic to only the approved AWS Regions.

Question 7

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a policy that restricts SSH access (port 22) from the internet (0.0.0.0/0) in all VPCs across all accounts. The team wants to centrally define the allowed rules and automatically apply them to newly created VPCs and security groups, while also automatically remediating any existing non-compliant security groups. Which AWS service should the team use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides centralized management of firewall rules across all accounts in AWS Organizations. It can enforce a common security group rule to deny SSH access from 0.0.0.0/0, automatically apply this policy to new VPCs and security groups, and remediate non-compliant existing security groups by removing or replacing violating rules. This meets the requirement for both proactive enforcement and automated remediation at scale.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Identity and Access Management (IAM)

Question 8

A company stores sensitive customer data in Amazon S3 buckets. The company's security policy requires that all objects in these buckets be encrypted at rest using an encryption key that the company can rotate annually and audit for usage. The company also needs to control which IAM users and roles can use, create, and manage these keys. The security team wants to use an AWS managed service to handle the key management lifecycle. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a managed service that allows you to create, rotate, and audit customer-managed keys (CMKs) used for encrypting S3 objects at rest. KMS integrates with AWS CloudTrail to log every key usage, enabling the required audit trail, and supports annual key rotation via automatic or manual rotation. It also provides fine-grained IAM policies and key policies to control which users and roles can use, create, and manage the keys, meeting all stated requirements.

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C)

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 9

A company manages multiple AWS accounts using AWS Organizations and maintains hundreds of Amazon S3 buckets across these accounts. The security team wants a service that automatically scans all S3 bucket policies and identifies any bucket that grants access to an external AWS account (an account outside the organization). The team needs to receive findings when such policies are detected and wants to review the findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources shared with external principals by analyzing resource-based policies (such as S3 bucket policies). It can be configured to use a trusted zone (e.g., the AWS Organizations management account or a specific OU) so that any policy granting access to an AWS account outside that zone generates a finding. These findings are aggregated in the IAM Access Analyzer console, providing a centralized dashboard for review.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Service Catalog

Question 10

A company manages multiple AWS accounts using AWS Organizations. The company wants employees to sign in using their existing corporate credentials from an on-premises Microsoft Active Directory. The company also needs a single sign-on (SSO) experience so that each employee can access the AWS Management Console for any authorized account without needing separate passwords. Additionally, the company wants to centrally manage permissions across all accounts. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage single sign-on (SSO) access to multiple AWS accounts and applications. It integrates with an on-premises Microsoft Active Directory via the AWS Directory Service or an external identity provider, allowing employees to use their existing corporate credentials. IAM Identity Center also enables you to centrally define and manage permissions across all accounts in AWS Organizations, meeting all stated requirements.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Directory Service

Answer

Amazon Cognito

Question 11

A company is preparing for a PCI DSS compliance audit. The security team needs to ensure that all AWS API calls are logged and that the logs are continuously analyzed for suspicious or unauthorized activity. The team wants a managed security service that uses machine learning to identify threats, generates findings for review, and can trigger automated remediation through AWS Lambda. Which AWS service should the team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS API calls (via CloudTrail), VPC Flow Logs, and DNS logs for suspicious activity. It generates actionable security findings and can trigger automated remediation through AWS Lambda, making it the correct choice for the described requirements.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 12

A company's security team discovers that database credentials are stored in plaintext in application configuration files. The team wants to implement a secure way to store, manage, and automatically rotate these credentials every 90 days. The solution must provide fine-grained IAM policies to control which users and applications can access the secrets and must integrate with AWS services like Amazon RDS for automatic rotation. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It supports automatic rotation every 90 days for Amazon RDS, Aurora, Redshift, and DocumentDB with built-in Lambda rotation functions, and it integrates with IAM for fine-grained access control via resource-based and identity-based policies.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Identity and Access Management (IAM)

Question 13

A company runs a web application on Amazon CloudFront and an Application Load Balancer (ALB). The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS). Additionally, the company needs to block requests from specific countries due to compliance requirements. The security team prefers a managed service that provides pre-configured rule sets and integrates directly with CloudFront and ALB without requiring additional infrastructure. Which AWS service should the security team use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects web applications from common exploits like SQL injection and cross-site scripting (XSS) using pre-configured rule sets (e.g., AWS Managed Rules). It integrates natively with both CloudFront and Application Load Balancers (ALBs) without requiring additional infrastructure, and it supports geo-blocking to restrict requests from specific countries, meeting all stated requirements.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Question 14

A company is preparing for a SOC 2 Type II audit and needs to provide its auditor with evidence of AWS's operational security controls. The security team has been asked to download the latest SOC 2 Type II report published by AWS. The team must access the report through a self-service portal without needing to contact AWS Support. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a self-service portal for downloading AWS compliance reports, including SOC 2 Type II reports, without needing to contact AWS Support. It offers on-demand access to AWS’s security and compliance documents, directly meeting the requirement for auditor evidence.

Answer

AWS Audit Manager

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 15

A financial services company uses AWS CloudTrail to log all API calls in its AWS account. The company must demonstrate to auditors that the CloudTrail log files have not been tampered with after they were delivered to the Amazon S3 bucket. The company wants to use a feature that automatically creates digest files containing a hash of each log file, allowing the auditor to mathematically verify the integrity of the logs. Which AWS feature should the company enable to meet this requirement?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation is the correct feature because it automatically creates digest files that contain a hash of each log file. These digest files are themselves signed using a private key, and the corresponding public key is published by AWS, enabling auditors to mathematically verify that the log files have not been tampered with after delivery to S3.

Answer

S3 Object Lock

Answer

AWS Config conformance packs

Answer

Amazon Detective