CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS WAF

  Why it's wrong here

  AWS WAF is a web application firewall that operates at Layer 7, inspecting HTTP/HTTPS requests to block application-layer threats such as SQL injection, cross-site scripting, and bot traffic. It does not mitigate volumetric network-layer DDoS attacks that saturate bandwidth or exhaust network resources, which is the core problem Shield Standard addresses. Additionally, WAF incurs charges for the rules you create and the requests you process, so it would not satisfy the 'no additional cost' constraint even if it were the right tool for this attack type.

  When this WOULD be correct

  When a company needs to protect a web application from common web exploits like SQL injection or cross-site scripting, and requires customizable rules to filter HTTP/S requests, AWS WAF would be the correct answer.

• ✓

  AWS Shield Standard

  Why this is correct

  AWS Shield Standard is a free, always-on service that automatically detects and mitigates common network-layer and transport-layer DDoS attacks, including SYN floods, UDP reflections, and amplification attacks. Because it is enabled by default for every AWS customer and requires no configuration, it protects a public web application on EC2 with no additional cost. Shield Standard automatically covers the Elastic IP and public interfaces of EC2, directly meeting the company's requirement for zero additional expense while addressing the network-layer DDoS threat.

• ✗

  AWS Shield Advanced

  Why it's wrong here

  AWS Shield Advanced provides enhanced DDoS protection, including cost protection, access to the DDoS Response Team, and near real-time visibility, but it is a paid service. The company specifically wants a service at no additional cost, so Shield Advanced does not meet that requirement.

  When this WOULD be correct

  AWS Shield Advanced would be correct if the question specified a need for enhanced protection against sophisticated DDoS attacks, 24/7 access to the DDoS Response Team (DRT), cost protection against scaling charges, or integration with AWS WAF for web-layer attacks, and the company is willing to pay the associated fee.

• ✗

  AWS Network Firewall

  Why it's wrong here

  AWS Network Firewall is a managed firewall service that provides stateful inspection, intrusion prevention, and traffic filtering. It is not designed to specifically mitigate DDoS attacks and does not provide always-on, automatic DDoS protection at no cost.

  When this WOULD be correct

  A company needs to deploy stateful firewall rules to inspect and filter inbound and outbound traffic at the VPC level, such as blocking traffic from specific IP addresses or enforcing domain-based filtering. The question would specify requirements for deep packet inspection or network traffic filtering beyond DDoS protection.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question