CLF-C02 Security and Compliance 2

Question 1

Which AWS service provides automated security findings by analyzing CloudTrail logs, VPC Flow Logs, and DNS logs for malicious activity?

Accepted Answer

AWS GuardDuty

Answer

AWS GuardDuty is a threat detection service that continuously monitors CloudTrail, VPC Flow Logs, and DNS logs to identify malicious or unauthorized behavior.

Question 2

Under the AWS Shared Responsibility Model, who is responsible for patching the underlying hypervisor in an EC2 environment?

Accepted Answer

AWS

Answer

AWS is responsible for patching the hypervisor and underlying infrastructure (security 'of' the cloud), while customers patch the guest OS and applications.

Question 3

A company wants to receive compliance reports and security documentation about AWS services such as SOC 2 and ISO 27001. Which service should they use?

Accepted Answer

AWS Artifact

Answer

AWS Artifact is a self-service portal that provides on-demand access to AWS compliance reports and security agreements such as SOC, PCI, and ISO certifications.

Question 4

Which AWS feature allows administrators to set permission guardrails across all accounts in an AWS Organization, preventing certain actions even by account root users?

Accepted Answer

Service Control Policies (SCPs)

Answer

Service Control Policies (SCPs) in AWS Organizations set maximum permission boundaries for all accounts, restricting actions organization-wide regardless of individual IAM policies.

Question 5

Which type of AWS IAM credential should be used by an application running on an EC2 instance to securely access other AWS services?

Accepted Answer

An IAM role attached to the EC2 instance

Answer

IAM roles attached to EC2 instances provide temporary, automatically rotated credentials that are the most secure way for applications to access AWS services.

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

CLF-C02 Security and Compliance 2