CLF-C02 Security and Compliance Practice Test 7 — 15 Questions

Question 1

A company manages 20 AWS accounts under AWS Organizations. The security team wants to ensure that no security group in any account allows unrestricted inbound RDP access (0.0.0.0/0). They need to automatically detect any security group that violates this rule and receive a notification. They also want to track the configuration history of security group changes for forensic analysis. Which AWS service should they use to achieve these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules like 'restricted-common-ports' or a custom Lambda rule to detect security groups with inbound RDP access from 0.0.0.0/0. It continuously evaluates resource configurations, sends Amazon SNS notifications on noncompliant resources, and automatically records a configuration history of all security group changes, enabling forensic analysis. This directly meets the requirements for detection, notification, and historical tracking.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS CloudTrail

Question 2

A company's security policy requires that all Amazon S3 buckets have default encryption enabled (SSE-S3 or SSE-KMS). A recent audit found several buckets without encryption enabled. The company wants an automated solution to continuously monitor all existing and new S3 buckets, detect any bucket that does not have default encryption enabled, and automatically remediate by enabling encryption. The solution must also maintain a compliance score and allow the security team to review non-compliant resources. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action using an AWS Systems Manager Automation document. AWS Config with the managed rule `s3-bucket-server-side-encryption-enabled` continuously evaluates S3 buckets against the encryption requirement. When a non-compliant bucket is detected, an automatic remediation action can invoke an AWS Systems Manager Automation document to enable default encryption (SSE-S3 or SSE-KMS). AWS Config also provides a compliance score dashboard and allows the security team to review non-compliant resources, meeting all stated requirements.

Answer

Amazon GuardDuty with a finding type for S3 bucket encryption

Answer

AWS Trusted Advisor with the S3 Bucket Permissions check

Answer

AWS CloudTrail with a trail that logs S3 API calls and an Amazon CloudWatch alarm

Question 3

A company operates a global e-commerce website behind Amazon CloudFront. Security analysts have noticed a pattern of SQL injection attempts and cross-site scripting attacks targeting the web application. The company needs a fully managed service that can inspect incoming HTTP(S) requests and block these common web exploits before they reach the application origin. The solution must integrate with CloudFront and allow the security team to author custom rules. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a fully managed web application firewall that integrates directly with Amazon CloudFront to inspect HTTP(S) requests. It provides pre-configured rule groups (e.g., the SQL injection and cross-site scripting rule sets) and allows the security team to author custom rules to block common web exploits before they reach the origin. This makes it the correct choice for the described use case.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 4

A company requires all IAM users to have multi-factor authentication (MFA) enabled for AWS Management Console access. The security team needs an automated way to continuously detect any IAM user without an MFA device and generate a compliance report. The solution must not require custom code. Which AWS service should the team use?

Accepted Answer

AWS Config. AWS Config is correct because it provides a managed, rules-based evaluation of AWS resource configurations. By enabling the 'iam-user-mfa-enabled' managed rule, AWS Config continuously checks all IAM users for the presence of an MFA device and can automatically trigger remediation actions or generate compliance reports via AWS Config aggregators, all without any custom code.

Answer

IAM Access Analyzer

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 5

A financial services company is preparing for an annual compliance audit. The compliance team needs to continuously assess whether their AWS environment adheres to industry standards such as PCI DSS. They want to automate the collection of evidence, such as IAM policy changes and S3 bucket configurations, and generate audit-ready reports. They also need to identify gaps in their controls and receive remediation recommendations. Which AWS service should the company use?

Accepted Answer

AWS Audit Manager. AWS Audit Manager is the correct choice because it is specifically designed to continuously assess compliance with industry standards like PCI DSS. It automates the collection of evidence (e.g., IAM policy changes, S3 bucket configurations) and generates audit-ready reports, while also identifying control gaps and providing remediation recommendations. This directly matches the company's need for automated evidence collection and gap analysis.

Answer

AWS Config

Answer

AWS Artifact

Answer

AWS Security Hub

Question 6

A company manages multiple AWS accounts under AWS Organizations. The security team wants to enforce a policy that prohibits launching Amazon EC2 instances of instance families g (GPU) and p (GPU) across all accounts to control costs. The team needs a centralized method to block these instance types at the organization level, and the policy must be applied proactively before any instance is launched. Which AWS solution should the team use?

Accepted Answer

Apply an AWS Organizations Service Control Policy (SCP) that denies ec2:RunInstances when the requested instance type belongs to the g or p families.. Option C is correct because AWS Organizations Service Control Policies (SCPs) are the only centralized mechanism that can proactively deny API actions across all accounts in the organization before the action occurs. By creating an SCP with a Deny effect on ec2:RunInstances where the instance type matches 'g*' or 'p*', the security team enforces the restriction at the root, OU, or account level, preventing any user or role from launching GPU instances regardless of their IAM permissions.

Answer

Create an AWS IAM policy with a Deny effect for ec2:RunInstances where the instance type starts with 'g' or 'p' and attach it to a specific IAM role in each account.

Answer

Use an AWS Config managed rule to detect GPU instance launches and trigger an auto-remediation action that terminates the instances.

Answer

Use AWS Trusted Advisor cost optimization checks to identify GPU instances and then manually disable them in each account.

Question 7

A company's security team wants to continuously monitor their AWS environment for potential security threats such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior that might indicate a compromised resource. They need a managed threat detection service that uses machine learning to identify suspicious activity and generates detailed findings. The service should integrate with AWS Organizations to monitor multiple accounts and with Amazon CloudWatch Events to trigger automated responses. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS environments for suspicious activity, such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior. It integrates natively with AWS Organizations to enable multi-account monitoring and with Amazon CloudWatch Events to trigger automated remediation workflows, directly matching all requirements in the question.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A financial services company stores confidential transaction records in Amazon S3. The company's compliance policy requires that all data at rest be encrypted using encryption keys that are under the company's full control. The keys must be automatically rotated every year. The company also needs a detailed audit trail of when each key was used and by which AWS principal. Which combination of AWS service and key type should the company use to meet these requirements?

Accepted Answer

Use AWS Key Management Service (AWS KMS) with a customer managed key and enable automatic key rotation.. Option D is correct because AWS KMS with a customer managed key allows the company to maintain full control over the encryption keys, enable automatic annual rotation, and provides detailed CloudTrail audit logs for every key usage, including the AWS principal that made the request. This satisfies the compliance requirements for encryption at rest, key rotation, and audit trail.

Answer

Use Amazon S3 server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager with automatic rotation enabled.

Answer

Use Amazon S3 server-side encryption with AWS managed keys (SSE-S3) and enable automatic key rotation.

Answer

Use AWS CloudHSM to generate and store the encryption keys, and configure an AWS Lambda function to rotate the keys every year and log usage to Amazon CloudWatch Logs.

Question 9

A company is migrating a legacy application from an on-premises server to AWS Lambda. The Lambda function needs to connect to an Amazon RDS for MySQL database that stores sensitive customer data. The security team requires that database credentials are never stored in the function's code, environment variables, or configuration files. The solution must follow AWS best practices for securing database access. Which approach should the company use?

Accepted Answer

Configure the Lambda function to use an IAM role with permissions to connect to the RDS database using IAM database authentication.. Option C is correct because IAM database authentication eliminates the need to store any credentials in code, environment variables, or configuration files. The Lambda function assumes an IAM role that generates an authentication token using the AWS Signature Version 4 process, which is then used as a password to connect to the RDS MySQL database. This approach meets the security team's requirement and follows AWS best practices by leveraging short-term, rotated credentials without embedding secrets.

Answer

Store the database password in AWS Secrets Manager and retrieve it from within the Lambda function code.

Answer

Store the database password in AWS Systems Manager Parameter Store as a SecureString and retrieve it from within the Lambda function.

Answer

Encrypt the database password using AWS KMS and hardcode the encrypted password in the Lambda function code.

Question 10

A company hosts a public-facing web application behind an Application Load Balancer (ALB). The development team has recently identified that the application is vulnerable to common web attacks such as SQL injection and cross-site scripting (XSS). The security team wants to deploy a managed solution that can inspect incoming HTTP requests and block malicious traffic before it reaches the application. The solution must integrate directly with the existing ALB and provide pre-configured rule sets that can be customized. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a managed web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests. It provides pre-configured rule sets, such as those for SQL injection and cross-site scripting (XSS), which can be customized to block malicious traffic before it reaches the application. This makes it the correct choice for the described use case.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 11

A company runs a multi-tier web application on Amazon EC2 instances. The security team wants to continuously monitor the configuration of the EC2 security groups to ensure that no security group allows inbound SSH (port 22) access from the entire internet (0.0.0.0/0). If a security group is modified to allow such access, the company must be automatically notified and provided with a detailed record of the change, including the user who made the change. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

AWS Config with a managed rule to check for unrestricted SSH access, and Amazon Simple Notification Service (Amazon SNS) to send notifications when the rule is non-compliant.. AWS Config continuously monitors the configuration of AWS resources, including security groups, and can evaluate them against managed rules such as 'restricted-ssh' (which checks that inbound SSH traffic is not allowed from 0.0.0.0/0). When a security group becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the security team, and the detailed configuration history (including the user who made the change via CloudTrail integration) is available in the AWS Config timeline. This combination directly meets the requirements for continuous monitoring, automatic notification, and a detailed record of the change.

Answer

AWS CloudTrail to log all API calls, and Amazon CloudWatch Logs to analyze the logs for security group modifications and trigger a notification.

Answer

AWS Trusted Advisor to check for security groups with unrestricted SSH access on a periodic basis, and Amazon Simple Email Service (Amazon SES) to send email alerts.

Answer

AWS Systems Manager Inventory to collect configuration data from EC2 instances, and Amazon CloudWatch Events to trigger a Lambda function that checks security group rules.

Question 12

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a consistent set of security group rules across all accounts. For example, they want to ensure that no security group in any account allows inbound SSH (port 22) from the internet (0.0.0.0/0). If a non-compliant security group is created, the service should automatically remediate by removing the offending rule or by applying a corrective policy. The company wants a managed AWS service that centrally applies these rules and requires no custom scripting. Which AWS service should the security team use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides a centralized, managed way to apply security group rules across all accounts in an AWS Organization. It can automatically detect non-compliant security groups (e.g., those allowing SSH from 0.0.0.0/0) and remediate them by removing the offending rule or applying a corrective policy, all without custom scripting.

Answer

AWS Config

Answer

AWS Organizations

Answer

AWS Shield Advanced

Question 13

A retail company processes credit card payments and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to obtain an official document from AWS that details the security controls AWS has implemented to support PCI DSS compliance for services such as Amazon RDS and Amazon EC2. The document must be downloadable as a PDF for review and audit purposes. Which AWS service should the compliance officer use to retrieve this document?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports and security documents, including the PCI DSS compliance attestation and responsibility summary. The compliance officer can download the AWS PCI DSS compliance package as a PDF directly from the AWS Artifact console, which is specifically designed for audit and review purposes.

Answer

AWS Security Hub

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 14

A company uses an Amazon RDS for PostgreSQL database for its production application. The security policy requires that database passwords be rotated automatically every 90 days. The database credentials are currently stored in a configuration file on an Amazon EC2 instance. The company wants a fully managed AWS service that can securely store the credentials, automatically rotate them on a schedule, and update the RDS instance without requiring code changes to the application. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a fully managed service designed specifically to securely store database credentials, automatically rotate them on a defined schedule (e.g., every 90 days), and natively integrate with Amazon RDS to update the password without requiring any application code changes. The application can retrieve the current credentials at runtime using the Secrets Manager API, eliminating the need for hardcoded or file-based credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Certificate Manager (ACM)

Question 15

A company runs a web application on an Application Load Balancer (ALB) in the us-east-1 Region. The application serves HTTPS traffic. The company uses a third-party certificate authority to issue SSL/TLS certificates, but these certificates expire every year and require manual renewal. The company wants to use a managed AWS service to automatically provision, renew, and manage the SSL/TLS certificates for the ALB at no additional cost (no extra charge beyond the ALB usage). Which AWS service should the company use?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it can provision, manage, and automatically renew public SSL/TLS certificates for use with an Application Load Balancer at no additional cost. ACM integrates directly with ALB to handle certificate deployment and renewal, eliminating the need for manual renewal of third-party certificates. The service is free for public certificates used with supported AWS services like ALB, CloudFront, and API Gateway.

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS WAF

Answer

AWS Secrets Manager