CLF-C02 Security and Compliance Practice Test 9 — 15 Questions

Question 1

A financial services company is preparing for an annual third-party audit. The auditor has requested a copy of the AWS SOC 2 Type II report to evaluate the security controls of the AWS infrastructure. The company needs to retrieve the report as quickly as possible without raising a support ticket. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications, without needing to open a support ticket. The auditor's request for a SOC 2 Type II report is exactly the use case AWS Artifact is designed for, allowing the company to download the report immediately from the AWS Management Console or via the AWS CLI.

Answer

AWS Security Hub

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 2

A company has a security policy that requires all Amazon EBS volumes attached to production Amazon EC2 instances to be encrypted at rest using customer-managed encryption keys. The policy also mandates that the encryption keys must be automatically rotated every 365 days. The company wants to minimize operational overhead by using a managed AWS service for key management and automatic rotation. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS is the correct choice because it provides managed customer master keys (CMKs) that can be used to encrypt EBS volumes at rest, and it supports automatic annual key rotation (every 365 days) with no additional operational overhead. KMS integrates directly with EBS to enforce encryption using customer-managed keys, meeting both the encryption and rotation requirements.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 3

A company wants to automatically detect potential security threats such as compromised credentials, unauthorized access attempts, and communication with known malicious IP addresses across its AWS environment. The company has enabled AWS CloudTrail, VPC Flow Logs, and DNS logs. Which AWS service should the company use to continuously analyze these logs and generate actionable security findings without requiring manual setup of data sources?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously analyzes AWS CloudTrail, VPC Flow Logs, and DNS logs using machine learning and anomaly detection to identify compromised credentials, unauthorized access, and communication with known malicious IP addresses. It operates without requiring manual setup of data sources because it automatically ingests these logs once enabled, generating actionable security findings.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 4

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) at the edge, before the requests reach the application. The company wants to use pre-built rule sets maintained by AWS to quickly enable protection, and the solution should be fully managed with no servers to manage. Which AWS service should the company use?

Accepted Answer

AWS WAF. AWS WAF is a fully managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates with Application Load Balancers (ALBs) and allows you to use pre-built, AWS-managed rule sets (e.g., the AWS Managed Rules for SQL injection and XSS) to quickly enable protection at the edge, before traffic reaches the EC2 instances. This meets the requirement for a serverless, managed solution with no infrastructure to maintain.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Network Firewall

Question 5

An e-commerce company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer and Amazon CloudFront. The application has been experiencing frequent, large-scale DDoS attacks that cause significant compute and data transfer costs. The company wants to implement a managed DDoS protection service that provides financial protection against scaling costs incurred during DDoS attacks, access to a DDoS Response Team (DRT) for real-time attack mitigation support, and integration with AWS WAF for application-layer attack protection. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced is the correct choice because it provides enhanced DDoS protection with financial protection against scaling costs incurred during DDoS attacks (cost protection for EC2, ELB, CloudFront, and Route 53), 24/7 access to the DDoS Response Team (DRT) for real-time attack mitigation, and seamless integration with AWS WAF for application-layer attack protection. This fully managed service meets all three stated requirements, unlike the other options.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 6

A company uses multiple AWS accounts within AWS Organizations. The security team needs to automatically check that no Amazon S3 bucket in any account has public read or write access. They want to define a security rule once and have it evaluated continuously across all accounts. The team also needs to view the overall compliance status from a single dashboard. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (such as 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited') that can be defined once in a delegated administrator account and automatically evaluated across all member accounts in AWS Organizations. It continuously monitors S3 bucket configurations and aggregates compliance results into a single dashboard (the AWS Config aggregator), meeting the requirement for a unified view of overall compliance status.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Shield

Question 7

A company handles credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to review AWS's PCI DSS compliance reports and also download and sign the AWS Business Associate Addendum (BAA) for HIPAA eligibility. The company wants a single, managed AWS service that provides on-demand access to these compliance documents and agreements. Which AWS service should the compliance officer use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports (including PCI DSS reports) and agreements such as the Business Associate Addendum (BAA) for HIPAA. It allows the compliance officer to review, download, and sign these documents directly from the AWS Management Console, meeting the requirement for a single managed service.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

Amazon Inspector

Question 8

A company has a compliance policy requiring that all data at rest in Amazon S3 be encrypted with a key that is automatically rotated every year. The company wants to manage the encryption keys themselves, maintain control over access policies, and have AWS handle the key rotation automatically. Which AWS service should the company use?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS allows you to create customer managed keys (CMKs) with automatic annual rotation enabled. You retain control over key policies and access permissions, while AWS handles the rotation of the key material. This satisfies the compliance requirement for encrypted data at rest in S3 with automatic yearly key rotation.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Question 9

A company runs a data analytics application on an Amazon EC2 instance. The application needs to read CSV files from an Amazon S3 bucket to process them. The security team requires that no long-term AWS credentials (access key ID and secret access key) be stored on the instance. The instance is already launched in a private subnet within a VPC. Which solution meets the security requirement and provides the necessary access?

Accepted Answer

Create an IAM role with the required S3 read permissions. Attach the role to the EC2 instance profile.. It uses an IAM role attached to an EC2 instance profile, which allows the application to obtain temporary AWS credentials via the instance metadata service (IMDS). This eliminates the need to store long-term access keys on the instance, satisfying the security requirement while granting the necessary S3 read permissions.

Answer

Store the AWS access key ID and secret access key in a configuration file on the instance's local disk.

Answer

Write a resource-based policy on the S3 bucket that allows access based on the private IP address of the EC2 instance.

Answer

Create a new IAM user with the required permissions. Store the IAM user's access key and secret key in AWS Systems Manager Parameter Store, and configure the application to retrieve them at runtime.

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to enforce a policy that prevents any user, including account administrators, from creating Amazon S3 buckets that are publicly accessible across the entire organization. The policy must be centrally managed and cannot be overridden by individual account administrators. Which AWS feature should the security team use?

Accepted Answer

Service Control Policies (SCPs) in AWS Organizations. Service Control Policies (SCPs) in AWS Organizations are the correct choice because they allow the security team to centrally define a policy that denies the creation of publicly accessible S3 buckets across all accounts in the organization. SCPs apply to all users, including account administrators, and cannot be overridden by any IAM policy or local account permissions, ensuring organization-wide enforcement.

Answer

AWS Config rules with auto-remediation

Answer

AWS Identity and Access Management (IAM) policies with a Deny effect

Answer

Amazon Macie with automated response

Question 11

A healthcare company is migrating patient records to Amazon S3. The company must comply with HIPAA and needs to automatically identify any S3 buckets that contain protected health information (PHI) and generate alerts. The solution must be fully managed and require no manual effort to scan the data. Which AWS service should the company use?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in Amazon S3. It automatically identifies protected health information (PHI) such as medical record numbers, diagnosis codes, and patient names, and can generate alerts when such data is found in S3 buckets, meeting HIPAA compliance requirements without any manual scanning effort.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Security Hub

Question 12

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS for MySQL database. Currently, the database administrator (DBA) hardcodes the database password in the application configuration file. A recent security audit recommends removing the password from the code and implementing automated password rotation every 30 days. The company wants a managed AWS service that can store the password securely and rotate it on a schedule without requiring custom code. Which AWS service should the company use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is a managed service specifically designed to securely store database credentials and other secrets, with built-in capability to automatically rotate passwords on a defined schedule (e.g., every 30 days) without requiring custom code. It integrates natively with Amazon RDS for MySQL, enabling automated rotation of the master user password via a pre-built Lambda function, which directly addresses the security audit's requirement to remove hardcoded passwords and implement rotation.

Answer

AWS KMS (Key Management Service)

Answer

AWS Systems Manager Parameter Store

Answer

AWS IAM (Identity and Access Management)

Question 13

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to serve traffic over HTTPS to encrypt data in transit between clients and the ALB. The security team requires that the SSL/TLS certificate be automatically renewed before expiration and that AWS manage the entire certificate lifecycle. The company does not want to manually upload or manage private keys. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct choice because it integrates directly with Application Load Balancers to provision, deploy, and automatically renew SSL/TLS certificates. ACM manages the entire certificate lifecycle, including private key generation and storage, without requiring manual intervention. This meets the security team's requirement for automatic renewal and AWS-managed certificate lifecycle.

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Question 14

A company manages over 100 AWS accounts using AWS Organizations. The security team wants a centralized service that continuously monitors for malicious or unauthorized behavior across all accounts. The service must analyze AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs to automatically detect threats such as anomalous API calls, crypto-mining activity, and compromised credentials. The security team wants to receive actionable alerts without having to write custom detection rules or manage underlying infrastructure. Which AWS service should the security team use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It natively analyzes AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs across all accounts in an AWS Organization, automatically generating actionable alerts without requiring custom rules or infrastructure management.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 15

A company's internal audit team needs to download the latest AWS SOC 2 Type II report and ISO 27001 certificate to include in their compliance documentation for an upcoming external audit. The team requires a centralized, self-service portal where they can access these reports and any other relevant AWS compliance artifacts. They do not want to contact AWS Support or manage any infrastructure to obtain these documents. Which AWS service should the audit team use?

Accepted Answer

AWS Artifact. AWS Artifact is the correct service because it provides a centralized, self-service portal for on-demand access to AWS compliance reports, such as SOC 2 Type II and ISO 27001 certificates, without requiring any infrastructure management or contacting AWS Support. The audit team can simply log in, browse the available artifacts, and download the latest versions directly, meeting their requirement for a no-touch, self-service solution.

Answer

AWS Config

Answer

AWS Audit Manager

Answer

AWS Trusted Advisor