CLF-C02 Security and Compliance Practice Question
A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) at the edge, before the requests reach the application. The company wants to use pre-built rule sets maintained by AWS to quickly enable protection, and the solution should be fully managed with no servers to manage. Which AWS service should the company use?
⚠ Common exam trap
Candidates often confuse AWS WAF with AWS Shield Advanced, mistakenly thinking Shield Advanced handles application-layer attacks like SQL injection, when in fact it focuses on DDoS mitigation at the network and transport layers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF
AWS WAF is a fully managed web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates with Application Load Balancers (ALBs) and allows you to use pre-built, AWS-managed rule sets (e.g., the AWS Managed Rules for SQL injection and XSS) to quickly enable protection at the edge, before traffic reaches the EC2 instances. This meets the requirement for a serverless, managed solution with no infrastructure to maintain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced provides enhanced protection against distributed denial-of-service (DDoS) attacks. It is not designed to inspect application-layer payloads for SQL injection or XSS. While it can be used in conjunction with AWS WAF, Shield Advanced alone does not offer the rule-based filtering needed for these specific web exploits.
When this WOULD be correct
A company needs protection against large-scale DDoS attacks targeting its web application, and requires 24/7 access to the DDoS Response Team (DRT) and cost protection against scaling charges during attacks.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts, workloads, and data sources (e.g., CloudTrail logs, VPC Flow Logs, DNS logs). It does not function as a web application firewall and cannot block specific web requests at the application layer.
When this WOULD be correct
A company wants to continuously monitor AWS accounts and workloads for malicious activity and unauthorized behavior, using machine learning and threat intelligence, with no need to block attacks in real-time. GuardDuty would be the correct service to detect potential threats across AWS resources.
- ✓
AWS WAF
Why this is correct
AWS WAF is a fully managed web application firewall that enables customers to monitor and control HTTP(S) requests to their applications. It provides managed rule groups for common threats like SQL injection and cross-site scripting (XSS). The service integrates seamlessly with Application Load Balancers, allowing traffic to be inspected at the edge before reaching the backend instances, and requires no server management.
- ✗
AWS Network Firewall
Why it's wrong here
AWS Network Firewall is a managed firewall service that provides network-level filtering for VPC traffic, including stateful and stateless inspection and intrusion prevention. It operates at Layers 3 and 4, not at the application layer (Layer 7). While it can provide some threat protection, it is not designed to inspect application-layer attacks like SQL injection or XSS, and it does not offer the pre-configured web-application rule sets that AWS WAF provides.
When this WOULD be correct
A company needs to filter outbound traffic from a VPC to block known malicious IPs or domains, or to inspect traffic between VPCs and on-premises networks using stateful firewall rules. The question would specify network-level filtering requirements, not web application protection.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS WAFCorrect answer▾
Why this is correct
AWS WAF is a fully managed web application firewall that enables customers to monitor and control HTTP(S) requests to their applications. It provides managed rule groups for common threats like SQL injection and cross-site scripting (XSS). The service integrates seamlessly with Application Load Balancers, allowing traffic to be inspected at the edge before reaching the backend instances, and requires no server management.
✗AWS Shield AdvancedWrong answer — click to see why▾
Why this is wrong here
AWS Shield Advanced provides DDoS protection, not application-layer filtering for SQL injection or XSS. It does not offer pre-built rule sets for web attacks.
★ When this WOULD be the correct answer
A company needs protection against large-scale DDoS attacks targeting its web application, and requires 24/7 access to the DDoS Response Team (DRT) and cost protection against scaling charges during attacks.
Why candidates choose this
Candidates may confuse 'edge protection' with DDoS mitigation, or assume Shield Advanced includes WAF capabilities since both are used for security at the edge.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not actively block web attacks like SQL injection or XSS at the edge. It operates on VPC Flow Logs, DNS logs, and CloudTrail events, not on incoming HTTP requests.
★ When this WOULD be the correct answer
A company wants to continuously monitor AWS accounts and workloads for malicious activity and unauthorized behavior, using machine learning and threat intelligence, with no need to block attacks in real-time. GuardDuty would be the correct service to detect potential threats across AWS resources.
Why candidates choose this
Candidates may confuse GuardDuty's threat detection capabilities with web application protection, assuming it can block attacks because it 'detects' threats. The name 'GuardDuty' also implies a security guard role, leading to overestimation of its preventive features.
✗AWS Network FirewallWrong answer — click to see why▾
Why this is wrong here
AWS Network Firewall is a managed firewall for VPC network traffic, not for web application layer attacks like SQL injection or XSS. It operates at layers 3-4 and 7 for network filtering, but lacks the pre-built web-specific rule sets that AWS WAF provides.
★ When this WOULD be the correct answer
A company needs to filter outbound traffic from a VPC to block known malicious IPs or domains, or to inspect traffic between VPCs and on-premises networks using stateful firewall rules. The question would specify network-level filtering requirements, not web application protection.
Why candidates choose this
Candidates may confuse 'firewall' with web application firewall, or assume that a network firewall can handle all types of attacks, including application-layer threats, due to the broad term 'firewall'.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.