CLF-C02 Security and Compliance Practice Test 4 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS MySQL database. The application requires database credentials to authenticate. The security team wants to eliminate the practice of storing database credentials in the application code or configuration files. Additionally, the team needs a managed service that can automatically rotate the database credentials on a regular schedule without any manual intervention. Which AWS service should the security team use to store and manage these database credentials?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a managed service specifically designed to store, manage, and automatically rotate database credentials (such as those for Amazon RDS MySQL) on a scheduled basis without manual intervention. It natively integrates with Amazon RDS to rotate credentials, eliminating the need to embed secrets in application code or configuration files, which directly addresses the security team's requirements.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Key Management Service (AWS KMS)

Question 2

A healthcare company is required to encrypt all protected health information (PHI) stored in Amazon S3. The company must maintain control over the encryption keys, rotate them annually, and log all key usage. Which AWS service or feature should they use to meet these requirements?

Accepted Answer

AWS Key Management Service (AWS KMS) with customer managed keys. AWS KMS with customer managed keys is correct because it allows the healthcare company to maintain full control over the encryption keys, enforce annual rotation (via automatic or manual key rotation), and log all key usage through AWS CloudTrail. This meets the compliance requirements for protecting PHI in S3 while retaining key management authority.

Answer

Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3)

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C)

Answer

AWS Certificate Manager (ACM)

Question 3

A company is deploying a three-tier web application on AWS. The security team requires a network-level firewall that operates at the subnet level and can evaluate both inbound and outbound traffic using stateless rules. Which AWS feature should the company use to meet this requirement?

Accepted Answer

Network ACLs. Network ACLs (NACLs) are a stateless, subnet-level firewall that evaluates both inbound and outbound traffic based on numbered rules. Unlike security groups, NACLs do not maintain connection state, so rules must be explicitly defined for both directions, meeting the requirement for stateless inspection at the subnet boundary.

Answer

Security Groups

Answer

AWS WAF

Answer

AWS Shield

Question 4

A financial services company is undergoing an external audit. The auditor requests copies of AWS SOC 2, ISO 27001, and PCI DSS compliance reports to validate the company's cloud infrastructure controls. Where can the company's compliance team obtain these reports in a centralized manner?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a centralized, self-service portal for on-demand access to AWS compliance reports, including SOC 2, ISO 27001, and PCI DSS. The compliance team can download these reports directly without needing to contact AWS support, making it the single source of truth for audit evidence.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Security Hub

Question 5

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits, including SQL injection and cross-site scripting (XSS). The solution must integrate directly with the ALB and allow custom rules to be defined. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP(S) requests. It provides managed rules to block common web exploits such as SQL injection and cross-site scripting (XSS), and allows you to define custom rules using conditions like IP addresses, HTTP headers, and URI strings. This makes it the correct choice for protecting the ALB-hosted application against these specific threats.

Answer

AWS Shield Advanced

Answer

Security Groups

Answer

AWS Firewall Manager

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants a preventive control to ensure that nobody in any account, including account root users, can disable AWS CloudTrail or delete Amazon S3 bucket policies. Which AWS feature should the security team use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct choice because they provide centralized preventive controls over the maximum available permissions for all IAM users, roles, and root users in member accounts within AWS Organizations. SCPs can explicitly deny actions such as cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:PutBucketPolicy, ensuring that even root users cannot disable CloudTrail or delete S3 bucket policies. This makes SCPs the only AWS feature that can enforce such restrictions across all accounts in an organization.

Answer

IAM roles with multi-factor authentication (MFA)

Answer

AWS Config rules with automatic remediation

Answer

AWS Shield Advanced

Question 7

A company operates hundreds of AWS accounts under AWS Organizations. The security team wants a single dashboard that aggregates security findings from Amazon GuardDuty, Amazon Inspector, and AWS Macie across all accounts. Additionally, they want to continuously assess the accounts against the CIS AWS Foundations Benchmark and receive a consolidated compliance score. Which AWS service should the security team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single dashboard that aggregates security findings from multiple AWS services, including GuardDuty, Inspector, and Macie, across all accounts in an AWS Organization. It also integrates with AWS Config rules to continuously assess accounts against the CIS AWS Foundations Benchmark and provides a consolidated compliance score, meeting both requirements.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 8

A healthcare company is subject to HIPAA regulations and must record all AWS API calls made in its account for auditing. The logs must be retained for 7 years and must be protected from any modification or deletion, including by the account root user. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

AWS CloudTrail with log file validation enabled, and store the log files in an Amazon S3 bucket with S3 Object Lock enabled in compliance mode. AWS CloudTrail with log file validation enabled ensures the integrity of the API call logs by using a digital signature (SHA-256 hash) to detect any tampering. Storing these logs in an Amazon S3 bucket with S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting the objects for the specified retention period (7 years), meeting HIPAA's immutable audit log requirements.

Answer

AWS Config with a HIPAA conformance pack, and store the configuration history in an Amazon S3 bucket with versioning enabled

Answer

Amazon GuardDuty with findings exported to an Amazon S3 bucket, and enable MFA Delete on the bucket

Answer

AWS CloudTrail with log file validation enabled, and store the log files in an Amazon S3 bucket with MFA Delete enabled

Question 9

A company wants to automatically evaluate its AWS resource configurations against internal security policies. The company has defined rules such as 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'. They need a service that continuously monitors resource configurations, identifies noncompliant resources, and provides a dashboard of compliance status over time. Which AWS service should the company use?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and records AWS resource configurations, evaluates them against custom rules (like 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'), and provides a compliance dashboard that shows historical compliance status over time. It directly addresses the need for automated, ongoing evaluation of resource configurations against internal security policies.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 10

A healthcare company stores sensitive patient data in Amazon S3. The company must comply with a regulation that requires encryption keys to be rotated automatically every 12 months. The security team also needs to use IAM policies to control which users and roles can decrypt specific S3 objects. Which encryption solution should the company use for the S3 objects?

Accepted Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer managed key. SSE-KMS with a customer managed key is correct because it allows automatic key rotation every 12 months (configurable via the AWS KMS console) and enables fine-grained access control through IAM policies and key policies. This meets both the regulatory rotation requirement and the security team's need to control decryption of specific S3 objects.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Client-side encryption using the AWS Encryption SDK

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3)

Question 11

A company's external auditor requires the company to provide evidence that the AWS infrastructure used by the company meets SOC 2 and ISO 27001 standards. The company needs to download the latest AWS SOC 2 report and ISO 27001 certification to share with the auditor. Which AWS service or feature should the company use to retrieve these documents?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS security and compliance reports, including SOC 2 and ISO 27001 certifications. The company can download the latest versions directly from the AWS Artifact console or API, satisfying the auditor's request for evidence without needing to configure any additional resources.

Answer

AWS Audit Manager

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 12

A company hosts a web application on AWS that uses Amazon CloudFront for content delivery and an Application Load Balancer (ALB) in front of Amazon EC2 instances. The security team wants to protect the application against common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that can inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Amazon CloudFront and Application Load Balancers (ALB) to inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. This makes it the correct choice for the security team's requirement to filter and block specific attack patterns at the application layer.

Answer

AWS Shield Advanced

Answer

AWS Firewall Manager

Answer

Amazon Inspector

Question 13

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that no Amazon S3 bucket in any account within the organization can be made publicly accessible. The team wants a centrally managed, preventive control that applies to all existing and future accounts and cannot be overridden by individual account administrators. Which AWS feature should the security team use to meet these requirements?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Service control policies (SCPs) in AWS Organizations allow you to centrally define and enforce permission guardrails across all accounts in the organization. An SCP that denies the `s3:PutBucketPublicAccessBlock` action and related public-access actions ensures that no S3 bucket can be made publicly accessible, and this policy applies to all existing and future accounts without being overridden by individual account administrators.

Answer

S3 Block Public Access account-level settings

Answer

AWS Config managed rule s3-bucket-public-read-prohibited

Answer

Amazon Macie with a sensitive data discovery job

Question 14

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The security team needs to understand their responsibilities under the AWS Shared Responsibility Model. Which of the following tasks is the customer's responsibility?

Accepted Answer

Configuring security group rules to control network access to the database. Under the AWS Shared Responsibility Model, the customer is responsible for configuring security group rules to control network access to the database. Security groups act as a virtual firewall that controls inbound and outbound traffic at the instance level, and the customer must define the rules (e.g., source IP, port 3306 for MySQL) to restrict access appropriately.

Answer

Applying minor version patches to the MySQL database engine

Answer

Managing the physical security of the data center where the RDS instance is hosted

Answer

Replacing failed hardware components in the RDS host server

Question 15

A company's security team needs to receive near-real-time notifications whenever an IAM user in their AWS account performs an action that violates a defined baseline of expected behavior. Examples include launching an Amazon EC2 instance in an unauthorized AWS Region or modifying a security group to allow public SSH access from the internet. The solution must analyze continuous streams of AWS API activity to identify suspicious patterns and known malicious IP addresses. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors AWS API activity, including CloudTrail management events, VPC Flow Logs, and DNS logs, to identify suspicious patterns and known malicious IP addresses. It uses machine learning and integrated threat intelligence to detect anomalous behavior such as launching EC2 instances in unauthorized regions or modifying security groups for public SSH access, and can deliver near-real-time notifications via Amazon EventBridge or SNS. This makes it the correct choice for analyzing continuous streams of API activity and alerting on violations of a defined baseline.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector