CLF-C02 Security and Compliance 4 — Questions and Answers
Question 1: Which AWS service allows you to create and manage encryption keys used to protect your data, with options for both AWS-managed and customer-managed keys?
- AWS Certificate Manager (ACM)
- AWS Secrets Manager
- AWS Key Management Service (KMS) (Correct answer)
- AWS CloudHSM
Correct answer: AWS Key Management Service (KMS)
AWS KMS is a managed service for creating and controlling cryptographic keys used to encrypt data across AWS services and custom applications.
Question 2: What is the key difference between AWS KMS and AWS CloudHSM?
- KMS supports symmetric encryption while CloudHSM only supports asymmetric encryption
- CloudHSM provides dedicated hardware security modules giving the customer full key control, while KMS is a shared multi-tenant service (Correct answer)
- KMS is only for encrypting S3 data while CloudHSM works with all AWS services
- CloudHSM is free while KMS charges per API call
Correct answer: CloudHSM provides dedicated hardware security modules giving the customer full key control, while KMS is a shared multi-tenant service
CloudHSM provides single-tenant, dedicated hardware security modules where the customer has exclusive control of the keys, unlike KMS which operates on shared AWS-managed infrastructure.
Question 3: Which of the following statements about AWS IAM roles is correct?
- IAM roles are permanent credentials assigned to a specific user
- IAM roles provide temporary security credentials and can be assumed by users, services, or applications (Correct answer)
- IAM roles can only be used by EC2 instances
- IAM roles require a username and password to authenticate
Correct answer: IAM roles provide temporary security credentials and can be assumed by users, services, or applications
IAM roles provide temporary, automatically rotated credentials and can be assumed by AWS services, applications, users, or even external identity providers.
Question 4: A company is using AWS and wants to ensure their usage meets HIPAA compliance requirements. What is the FIRST step they should take?
- Enable AWS Config rules for HIPAA
- Sign a Business Associate Agreement (BAA) with AWS (Correct answer)
- Enable AWS Shield Advanced
- Configure AWS GuardDuty for healthcare workloads
Correct answer: Sign a Business Associate Agreement (BAA) with AWS
To operate HIPAA-eligible workloads on AWS, customers must first sign a Business Associate Agreement (BAA) with AWS, which can be done through AWS Artifact.
Question 5: Which AWS service enables you to filter and monitor HTTP/HTTPS traffic to your web applications to protect against common exploits like SQL injection and cross-site scripting?
- AWS Shield
- AWS Network Firewall
- AWS WAF (Web Application Firewall) (Correct answer)
- Amazon GuardDuty
Correct answer: AWS WAF (Web Application Firewall)
AWS WAF is a web application firewall that lets you create rules to allow, block, or monitor web requests based on conditions you define, protecting against OWASP top-10 threats.
Question 6: What does enabling MFA (Multi-Factor Authentication) on an AWS root account protect against?
- Unauthorized S3 bucket access via public URLs
- Account takeover if the root account password is compromised (Correct answer)
- DDoS attacks on resources in the account
- Accidental deletion of IAM roles
Correct answer: Account takeover if the root account password is compromised
MFA on the root account adds a second authentication factor so that even if the password is stolen, an attacker cannot access the account without the physical MFA device or app.
Question 7: Which AWS service continuously monitors and records AWS resource configurations, enabling compliance auditing and change tracking?
- AWS CloudTrail
- AWS Config (Correct answer)
- Amazon Inspector
- AWS Trusted Advisor
Correct answer: AWS Config
AWS Config continuously records resource configuration changes and evaluates them against desired configurations, providing a configuration history and compliance timeline.
CLF-C02 Security and Compliance 4
Which AWS service allows you to create and manage encryption keys used to protect your data, with options for both AWS-managed and customer-managed keys?