Match each AWS security service to its function.
Drag a concept onto its matching description — or click a concept then click the description.
Manage user access and permissions
Create and manage encryption keys
DDoS protection
Web application firewall
Compliance reports and agreements
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
AWS WAF: Protects web applications from common web exploits
The correct matches are: AWS WAF protects web applications from common exploits; AWS Shield provides DDoS protection; AWS IAM manages access to AWS resources; AWS KMS creates and manages encryption keys. Common confusions include mixing up AWS WAF with CloudTrail (monitoring) or misattributing encryption key management to AWS Shield.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
AWS WAF: Protects web applications from common web exploits
Why this is correct
AWS WAF is a web application firewall that protects applications from common web exploits such as SQL injection and cross-site scripting (XSS). It uses rule statements to allow, block, or count requests based on IP addresses, headers, body content, or URI patterns. WAF integrates with Application Load Balancers, Amazon CloudFront, and API Gateway, and supports AWS-managed rule sets for the OWASP Top 10.
AWS Shield: Provides DDoS protection
Why this is correct
AWS Shield is a managed DDoS protection service that defends applications against network and transport layer attacks, including SYN floods, UDP floods, and reflection attacks. The Standard tier is automatically enabled for all AWS customers, providing always-on detection and inline mitigation. The Advanced tier adds higher protection, actionable visibility, and 24/7 access to the AWS DDoS Response Team, with integration to CloudFront and Route 53.
AWS IAM: Manages access to AWS services and resources
Why this is correct
AWS IAM is the identity and access management service that lets you define users, groups, roles, and permissions for using AWS resources. Through JSON-based policies, IAM grants least-privilege access to specific actions and resources, and supports MFA, federation, and cross-account roles. IAM is essential for enforcing authentication and authorization at the AWS API level.
AWS KMS: Creates and manages encryption keys
Why this is correct
AWS KMS creates and controls cryptographic keys, enabling centralized management of encryption for both storage and messaging services. Customer master keys (CMKs) are stored in FIPS 140-2 validated HSMs and can be used for symmetric, asymmetric, or envelope encryption. KMS integrates deeply with services like S3, EBS, and RDS, and records every key use in CloudTrail for auditing.
AWS WAF: Monitors API calls and user activity
Why it's wrong here
This pairing is incorrect because AWS WAF does not monitor API calls or user activity; it filters HTTP(S) requests at the web application layer. API-level monitoring is performed by AWS CloudTrail, which captures read and write events along with user identity information for audit and governance purposes. WAF's scope is the payload and structure of web requests, not the account's operational activity.
AWS Shield: Creates and manages encryption keys
Why it's wrong here
The description of AWS Shield as an encryption key manager is wrong: key creation and lifecycle management belong to AWS KMS, which uses hardware-backed CMKs. Shield's actual function is to mitigate volumetric and protocol DDoS attacks by absorbing and filtering malicious traffic before it reaches your applications. Confusing these services conflates data-at-rest protection with network resilience.
Go deeper
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.