CLF-C02 Security and Compliance 2 — Questions and Answers
Question 1: Which AWS service provides automated security findings by analyzing CloudTrail logs, VPC Flow Logs, and DNS logs for malicious activity?
- AWS Inspector
- AWS GuardDuty (Correct answer)
- AWS Macie
- AWS Config
Correct answer: AWS GuardDuty
AWS GuardDuty is a threat detection service that continuously monitors CloudTrail, VPC Flow Logs, and DNS logs to identify malicious or unauthorized behavior.
Question 2: Under the AWS Shared Responsibility Model, who is responsible for patching the underlying hypervisor in an EC2 environment?
- The customer
- AWS (Correct answer)
- Both AWS and the customer share this equally
- A third-party vendor
Correct answer: AWS
AWS is responsible for patching the hypervisor and underlying infrastructure (security 'of' the cloud), while customers patch the guest OS and applications.
Question 3: A company wants to receive compliance reports and security documentation about AWS services such as SOC 2 and ISO 27001. Which service should they use?
- AWS Trusted Advisor
- AWS Artifact (Correct answer)
- AWS Config
- AWS Security Hub
Correct answer: AWS Artifact
AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports and security agreements such as SOC, PCI, and ISO certifications.
Question 4: Which AWS feature allows administrators to set permission guardrails across all accounts in an AWS Organization, preventing certain actions even by account root users?
- IAM Permission Boundaries
- Service Control Policies (SCPs) (Correct answer)
- AWS Config Rules
- IAM Role Trust Policies
Correct answer: Service Control Policies (SCPs)
Service Control Policies (SCPs) in AWS Organizations set maximum permission boundaries for all accounts, restricting actions organization-wide regardless of individual IAM policies.
Question 5: Which type of AWS IAM credential should be used by an application running on an EC2 instance to securely access other AWS services?
- Hardcoded IAM user access keys in the application code
- An IAM role attached to the EC2 instance (Correct answer)
- A root account access key
- An MFA-protected IAM user
Correct answer: An IAM role attached to the EC2 instance
IAM roles attached to EC2 instances provide temporary, automatically rotated credentials that are the most secure way for applications to access AWS services.
Question 6: Which AWS service uses machine learning to automatically discover, classify, and protect sensitive data such as PII stored in Amazon S3?
- AWS GuardDuty
- Amazon Inspector
- Amazon Macie (Correct answer)
- AWS Shield
Correct answer: Amazon Macie
Amazon Macie uses machine learning to automatically discover and classify sensitive data (like PII and financial data) stored in S3 buckets.
Question 7: Which AWS service can be used to centrally view and manage security alerts and compliance status across multiple AWS accounts?
- AWS CloudTrail
- AWS Security Hub (Correct answer)
- Amazon Inspector
- AWS Organizations
Correct answer: AWS Security Hub
AWS Security Hub provides a centralized view of security alerts and compliance status aggregated from multiple AWS accounts and supported third-party services.
CLF-C02 Security and Compliance 2
Which AWS service provides automated security findings by analyzing CloudTrail logs, VPC Flow Logs, and DNS logs for malicious activity?