CLF-C02 Security and Compliance 3

Question 1

A company wants to prevent users in their AWS account from disabling AWS CloudTrail. Which is the MOST effective way to enforce this?

Accepted Answer

Apply a Service Control Policy (SCP) that denies cloudtrail:DeleteTrail

Answer

An SCP applied at the organizational level can explicitly deny the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions, preventing even privileged users from disabling CloudTrail.

Question 2

Which of the following BEST describes the principle of least privilege in AWS IAM?

Accepted Answer

Granting users only the minimum permissions required to perform their tasks

Answer

The principle of least privilege means users, roles, and services receive only the exact permissions necessary to perform their intended function, reducing the blast radius of compromised credentials.

Question 3

Which AWS service performs automated security assessments of EC2 instances and container workloads to identify software vulnerabilities and unintended network exposure?

Accepted Answer

Amazon Inspector

Answer

Amazon Inspector automatically assesses EC2 instances and ECR container images for software vulnerabilities (CVEs) and unintended network accessibility.

Question 4

Which of the following is a customer responsibility under the AWS Shared Responsibility Model when using Amazon RDS?

Accepted Answer

Configuring database security groups and network access controls

Answer

For managed services like RDS, customers are responsible for network access controls (security groups, NACLs) and database-level security configurations, while AWS handles OS and engine patching.

Question 5

Which AWS service provides DDoS protection automatically for all AWS customers at no additional cost?

Accepted Answer

AWS Shield Standard

Answer

AWS Shield Standard is automatically enabled for all AWS customers at no extra charge and provides protection against common network and transport layer DDoS attacks.

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

CLF-C02 Security and Compliance 3