CLF-C02 Security and Compliance Practice Test 3 — 15 Questions

Question 1

A company stores sensitive customer data in Amazon S3 buckets. The company's security policy requires that all objects in these buckets be encrypted at rest using an encryption key that the company can rotate annually and audit for usage. The company also needs to control which IAM users and roles can use, create, and manage these keys. The security team wants to use an AWS managed service to handle the key management lifecycle. Which AWS service should the company use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a managed service that allows you to create, rotate, and audit customer-managed keys (CMKs) used for encrypting S3 objects at rest. KMS integrates with AWS CloudTrail to log every key usage, enabling the required audit trail, and supports annual key rotation via automatic or manual rotation. It also provides fine-grained IAM policies and key policies to control which users and roles can use, create, and manage the keys, meeting all stated requirements.

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C)

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 2

A company manages multiple AWS accounts using AWS Organizations and maintains hundreds of Amazon S3 buckets across these accounts. The security team wants a service that automatically scans all S3 bucket policies and identifies any bucket that grants access to an external AWS account (an account outside the organization). The team needs to receive findings when such policies are detected and wants to review the findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources shared with external principals by analyzing resource-based policies (such as S3 bucket policies). It can be configured to use a trusted zone (e.g., the AWS Organizations management account or a specific OU) so that any policy granting access to an AWS account outside that zone generates a finding. These findings are aggregated in the IAM Access Analyzer console, providing a centralized dashboard for review.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Service Catalog

Question 3

A company manages multiple AWS accounts using AWS Organizations. The company wants employees to sign in using their existing corporate credentials from an on-premises Microsoft Active Directory. The company also needs a single sign-on (SSO) experience so that each employee can access the AWS Management Console for any authorized account without needing separate passwords. Additionally, the company wants to centrally manage permissions across all accounts. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage single sign-on (SSO) access to multiple AWS accounts and applications. It integrates with an on-premises Microsoft Active Directory via the AWS Directory Service or an external identity provider, allowing employees to use their existing corporate credentials. IAM Identity Center also enables you to centrally define and manage permissions across all accounts in AWS Organizations, meeting all stated requirements.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Directory Service

Answer

Amazon Cognito

Question 4

A company is preparing for a PCI DSS compliance audit. The security team needs to ensure that all AWS API calls are logged and that the logs are continuously analyzed for suspicious or unauthorized activity. The team wants a managed security service that uses machine learning to identify threats, generates findings for review, and can trigger automated remediation through AWS Lambda. Which AWS service should the team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS API calls (via CloudTrail), VPC Flow Logs, and DNS logs for suspicious activity. It generates actionable security findings and can trigger automated remediation through AWS Lambda, making it the correct choice for the described requirements.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 5

A company's security team discovers that database credentials are stored in plaintext in application configuration files. The team wants to implement a secure way to store, manage, and automatically rotate these credentials every 90 days. The solution must provide fine-grained IAM policies to control which users and applications can access the secrets and must integrate with AWS services like Amazon RDS for automatic rotation. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It supports automatic rotation every 90 days for Amazon RDS, Aurora, Redshift, and DocumentDB with built-in Lambda rotation functions, and it integrates with IAM for fine-grained access control via resource-based and identity-based policies.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS Identity and Access Management (IAM)

Question 6

A company runs a web application on Amazon CloudFront and an Application Load Balancer (ALB). The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS). Additionally, the company needs to block requests from specific countries due to compliance requirements. The security team prefers a managed service that provides pre-configured rule sets and integrates directly with CloudFront and ALB without requiring additional infrastructure. Which AWS service should the security team use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that protects web applications from common exploits like SQL injection and cross-site scripting (XSS) using pre-configured rule sets (e.g., AWS Managed Rules). It integrates natively with both CloudFront and Application Load Balancers (ALBs) without requiring additional infrastructure, and it supports geo-blocking to restrict requests from specific countries, meeting all stated requirements.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Question 7

A company is preparing for a SOC 2 Type II audit and needs to provide its auditor with evidence of AWS's operational security controls. The security team has been asked to download the latest SOC 2 Type II report published by AWS. The team must access the report through a self-service portal without needing to contact AWS Support. Which AWS service should the security team use to meet this requirement?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a self-service portal for downloading AWS compliance reports, including SOC 2 Type II reports, without needing to contact AWS Support. It offers on-demand access to AWS’s security and compliance documents, directly meeting the requirement for auditor evidence.

Answer

AWS Audit Manager

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 8

A financial services company uses AWS CloudTrail to log all API calls in its AWS account. The company must demonstrate to auditors that the CloudTrail log files have not been tampered with after they were delivered to the Amazon S3 bucket. The company wants to use a feature that automatically creates digest files containing a hash of each log file, allowing the auditor to mathematically verify the integrity of the logs. Which AWS feature should the company enable to meet this requirement?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation is the correct feature because it automatically creates digest files that contain a hash of each log file. These digest files are themselves signed using a private key, and the corresponding public key is published by AWS, enabling auditors to mathematically verify that the log files have not been tampered with after delivery to S3.

Answer

S3 Object Lock

Answer

AWS Config conformance packs

Answer

Amazon Detective

Question 9

A company has internal security policies that require all Amazon S3 buckets to be private (not publicly accessible) and all Amazon EC2 security groups to restrict inbound SSH traffic to a specific IP range. The security team needs to continuously monitor all AWS resources across their account to detect any resource that violates these policies. They also need a historical record of configuration changes and a compliance dashboard that shows overall pass/fail status. Which AWS service should the security team use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring, compliance auditing, and historical recording of configuration changes for AWS resources. It allows you to define rules (e.g., 's3-bucket-public-read-prohibited' and 'restricted-ssh') that automatically evaluate your S3 bucket policies and EC2 security group rules against your security policies, and it offers a compliance dashboard showing pass/fail status for each resource. AWS Config also maintains a configuration history that can be used for auditing and troubleshooting.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 10

A company runs a fleet of Amazon EC2 instances that host a customer-facing web application. The security team wants to automatically identify software vulnerabilities, such as missing patches and common vulnerabilities and exposures (CVEs), in the operating system and applications running on these instances. The team also needs visibility into unintended network accessibility, such as instances with ports open to the internet. The solution must be natively integrated with AWS and should provide findings that can be viewed in a central dashboard. Which AWS service should the security team use?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct choice because it is a vulnerability management service that automatically scans EC2 instances for software vulnerabilities (missing patches, CVEs) and unintended network accessibility (e.g., open ports to the internet). It is natively integrated with AWS and provides findings in a central dashboard via the AWS Management Console or AWS Security Hub. This directly matches the security team's requirements for automated identification of OS/application vulnerabilities and network exposure.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 11

A company stores sensitive audit reports in an Amazon S3 bucket. An external auditor needs to download a specific report for a compliance review. The auditor does not have an AWS account and will only need access for 48 hours. The company wants to provide a secure, time-limited link that allows the auditor to download the file directly from S3 without making the bucket public or requiring the auditor to authenticate with AWS. Which AWS feature should the company use to meet these requirements?

Accepted Answer

S3 presigned URL generated with a 48-hour expiration. An S3 presigned URL allows the company to grant temporary, time-limited access to a specific object in a private S3 bucket without requiring the auditor to have AWS credentials. By generating the URL with a 48-hour expiration, the company meets the exact requirement for secure, time-bound access. The auditor can download the file directly via HTTPS using the presigned URL, which embeds the necessary authentication information.

Answer

S3 bucket policy with a condition that restricts access by IP address

Answer

IAM role with cross-account access for the auditor's AWS account

Answer

CloudFront signed URL using a trusted key group

Question 12

A company uses Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scanning, and Amazon Macie for sensitive data discovery. The security team needs a centralized dashboard that aggregates findings from all these services, provides a security score, and tracks compliance against industry standards such as CIS AWS Foundations. Which AWS service should the security team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a centralized dashboard that aggregates findings from multiple AWS security services, including GuardDuty, Inspector, and Macie. It also offers a consolidated security score and supports automated compliance checks against standards like CIS AWS Foundations, making it the ideal choice for this use case.

Answer

AWS Config

Answer

Amazon Detective

Answer

AWS Trusted Advisor

Question 13

A company stores sensitive financial data in Amazon S3 and must encrypt it at rest. The compliance team mandates that the encryption key must be rotated at least once per year, and the key material must be generated and managed by the company within AWS. The company wants a fully automated solution that requires no manual intervention for key rotation. Which AWS service or feature should the company use?

Accepted Answer

Create an AWS KMS customer managed key and enable automatic annual rotation.. AWS KMS customer managed keys support automatic annual rotation, which satisfies the compliance requirement for key rotation without manual intervention. The company retains control over the key material since it is generated and managed within AWS KMS, meeting the mandate that the company manages the keys within AWS.

Answer

Use Amazon S3 server-side encryption with customer-provided encryption keys (SSE-C).

Answer

Use an AWS KMS AWS managed key (aws/s3) which automatically rotates the key every year.

Answer

Use AWS CloudHSM to generate and manage the key, and implement a custom cron job to rotate the key.

Question 14

A company is undergoing a compliance audit to demonstrate that its AWS environment adheres to industry standards such as PCI DSS and SOC. The auditor requests the company to provide the latest AWS compliance reports to verify the security controls implemented by AWS. The company needs to obtain these reports directly from AWS in a downloadable format. Which AWS service should the company use to meet this requirement?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC and PCI DSS reports, in a downloadable format. This allows the company to directly obtain the latest reports from AWS to share with auditors, meeting the compliance audit requirement without needing to configure or manage any other service.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS Security Hub

Question 15

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to enforce that all Amazon Elastic Block Store (EBS) volumes created in any account within the organization are automatically encrypted at rest. The team needs a centrally managed solution that proactively prevents the creation of unencrypted EBS volumes without requiring individual account administrators to enable any settings. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled. An SCP in AWS Organizations can centrally deny the ec2:CreateVolume API call unless the request includes a condition that encryption is enabled (e.g., ec2:Encrypted = true). This proactively prevents any user or role in any member account from creating an unencrypted EBS volume, regardless of individual account settings, meeting the requirement for a centrally managed, preventive control.

Answer

AWS Key Management Service (AWS KMS) with automatic key rotation

Answer

Amazon EBS encryption by default at the account level, configured via the EC2 console in each account

Answer

AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediation