CLF-C02 Security and Compliance 3 — Questions and Answers
Question 1: A company wants to prevent users in their AWS account from disabling AWS CloudTrail. Which is the MOST effective way to enforce this?
- Send CloudTrail logs to a separate S3 bucket with a bucket policy
- Apply a Service Control Policy (SCP) that denies cloudtrail:DeleteTrail (Correct answer)
- Enable MFA Delete on the CloudTrail S3 bucket
- Use AWS Config to monitor CloudTrail status
Correct answer: Apply a Service Control Policy (SCP) that denies cloudtrail:DeleteTrail
An SCP applied at the organizational level can explicitly deny the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions, preventing even privileged users from disabling CloudTrail.
Question 2: Which of the following BEST describes the principle of least privilege in AWS IAM?
- Granting root account access only to senior administrators
- Granting users only the minimum permissions required to perform their tasks (Correct answer)
- Using IAM groups instead of assigning policies directly to users
- Rotating access keys every 90 days
Correct answer: Granting users only the minimum permissions required to perform their tasks
The principle of least privilege means users, roles, and services receive only the exact permissions necessary to perform their intended function, reducing the blast radius of compromised credentials.
Question 3: Which AWS service performs automated security assessments of EC2 instances and container workloads to identify software vulnerabilities and unintended network exposure?
- Amazon Macie
- AWS GuardDuty
- Amazon Inspector (Correct answer)
- AWS Trusted Advisor
Correct answer: Amazon Inspector
Amazon Inspector automatically assesses EC2 instances and ECR container images for software vulnerabilities (CVEs) and unintended network accessibility.
Question 4: Which of the following is a customer responsibility under the AWS Shared Responsibility Model when using Amazon RDS?
- Patching the underlying database engine software
- Managing the physical security of the database servers
- Configuring database security groups and network access controls (Correct answer)
- Replacing failed hardware components
Correct answer: Configuring database security groups and network access controls
For managed services like RDS, customers are responsible for network access controls (security groups, NACLs) and database-level security configurations, while AWS handles OS and engine patching.
Question 5: Which AWS service provides DDoS protection automatically for all AWS customers at no additional cost?
- AWS WAF
- AWS Firewall Manager
- AWS Shield Standard (Correct answer)
- AWS Shield Advanced
Correct answer: AWS Shield Standard
AWS Shield Standard is automatically enabled for all AWS customers at no extra charge and provides protection against common network and transport layer DDoS attacks.
Question 6: What is the purpose of an IAM permission boundary?
- It sets the maximum permissions an IAM entity can have, regardless of their attached policies (Correct answer)
- It restricts the AWS regions where an IAM user can operate
- It prevents IAM users from creating additional IAM users
- It enforces multi-factor authentication for all API calls
Correct answer: It sets the maximum permissions an IAM entity can have, regardless of their attached policies
A permission boundary is an advanced IAM feature that sets the maximum permissions an IAM entity (user or role) can have, even if their identity-based policies grant more access.
Question 7: A security team needs to ensure all API calls made in their AWS account are logged for auditing. Which service provides this capability?
- Amazon CloudWatch Logs
- AWS CloudTrail (Correct answer)
- AWS Config
- VPC Flow Logs
Correct answer: AWS CloudTrail
AWS CloudTrail records all API calls made in an AWS account, including the identity of the caller, the time, source IP, request parameters, and response elements.
CLF-C02 Security and Compliance 3
A company wants to prevent users in their AWS account from disabling AWS CloudTrail.
Which is the MOST effective way to enforce this?