20+ practice questions focused on Security and Compliance — one of the most tested topics on the AWS Certified Cloud Practitioner CLF-C02 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security and Compliance PracticeA financial services company requires all data stored in Amazon S3 to be encrypted at rest. The company has a compliance policy that states encryption keys must be managed entirely by the customer and must never be stored or managed by the cloud provider. Which server-side encryption option should the company use for Amazon S3?
Explanation: SSE-C allows the customer to provide their own encryption keys for server-side encryption of S3 objects. The customer manages the keys entirely, and AWS does not store or manage them, meeting the compliance requirement that encryption keys must never be stored or managed by the cloud provider.
A company has a security policy that requires all SSH connections to Amazon EC2 instances to originate from the company's corporate network IP range (203.0.113.0/24). An administrator is creating an IAM policy to enforce this restriction. Which IAM policy element should the administrator use to specify the allowed IP address range?
Explanation: SSH connections to EC2 instances are network traffic, not AWS API calls. IAM policies cannot restrict SSH source IP addresses. None of the listed IAM condition keys (including aws:SourceIp) can enforce this requirement. The correct solution is a security group or network ACL allowing inbound TCP 22 only from 203.0.113.0/24. As written, this question has no correct option among A-D.
A company must store sensitive financial records in Amazon S3. The compliance policy mandates that the encryption key for data at rest must be generated and stored on the company's own on-premises hardware security module (HSM). The company must never allow AWS to have access to the plaintext encryption key. Which Amazon S3 encryption option should the company use?
Explanation: Client-side encryption using the AWS Encryption SDK encrypts data on the client side before uploading to S3. The encryption key is generated and stored on the company's on-premises HSM and is never shared with AWS. Therefore, AWS never has access to the plaintext key, satisfying the compliance mandate.
A company manages multiple AWS accounts under AWS Organizations. The security team wants to enforce a policy that prohibits launching Amazon EC2 instances of instance families g (GPU) and p (GPU) across all accounts to control costs. The team needs a centralized method to block these instance types at the organization level, and the policy must be applied proactively before any instance is launched. Which AWS solution should the team use?
Explanation: AWS Organizations Service Control Policies (SCPs) are the only centralized mechanism that can proactively deny API actions across all accounts in the organization before the action occurs. By creating an SCP with a Deny effect on ec2:RunInstances where the instance type matches 'g*' or 'p*', the security team enforces the restriction at the root, OU, or account level, preventing any user or role from launching GPU instances regardless of their IAM permissions.
A company is migrating a legacy application from an on-premises server to AWS Lambda. The Lambda function needs to connect to an Amazon RDS for MySQL database that stores sensitive customer data. The security team requires that database credentials are never stored in the function's code, environment variables, or configuration files. The solution must follow AWS best practices for securing database access. Which approach should the company use?
Explanation: AWS Secrets Manager is the AWS best practice for securely storing and retrieving database credentials for Lambda functions. It stores the password outside the function code, environment variables, and configuration files, and supports automatic rotation. While Parameter Store SecureString can store encrypted credentials, Secrets Manager is the recommended service for database credentials. IAM database authentication can eliminate static passwords but is not the primary answer for storing and handling database credentials in this scenario.
+15 more Security and Compliance questions available
Practice all Security and Compliance questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security and Compliance. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security and Compliance questions on the CLF-C02 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security and Compliance is tested as part of the AWS Certified Cloud Practitioner CLF-C02 blueprint. Practicing with targeted Security and Compliance questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CLF-C02 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security and Compliance is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security and Compliance practice session with instant scoring and detailed explanations.
Start Security and Compliance Practice →