CLF-C02 Security and Compliance 5 — Questions and Answers
Question 1: Which of the following is a security best practice for the AWS root account?
- Use the root account for daily administrative tasks to save time
- Share root account credentials with trusted team members only
- Enable MFA and avoid using the root account for routine tasks (Correct answer)
- Create access keys for the root account for programmatic access
Correct answer: Enable MFA and avoid using the root account for routine tasks
AWS best practice is to enable MFA on the root account and use it only for tasks that absolutely require root access, performing all other work with IAM users or roles.
Question 2: A company wants to protect sensitive database passwords and API keys used by their applications, with automatic rotation. Which AWS service is BEST suited for this?
- AWS Systems Manager Parameter Store (Standard)
- AWS Key Management Service (KMS)
- AWS Secrets Manager (Correct answer)
- AWS Certificate Manager
Correct answer: AWS Secrets Manager
AWS Secrets Manager is designed to store, manage, and automatically rotate secrets like database credentials and API keys, with built-in integration for RDS and other services.
Question 3: In the AWS Shared Responsibility Model, which of the following is a responsibility shared between AWS and the customer?
- Physical security of data centers
- Encryption of data at rest and in transit (Correct answer)
- Hypervisor patch management
- Employee background checks at AWS facilities
Correct answer: Encryption of data at rest and in transit
Encryption is a shared responsibility — AWS provides encryption tools and services, but the customer is responsible for deciding to enable encryption and managing their own keys.
Question 4: Which feature of AWS Organizations helps centrally manage and enforce consistent security policies such as restricting specific AWS regions across all member accounts?
- IAM Identity Center
- Service Control Policies (SCPs) (Correct answer)
- AWS Config Rules
- AWS Control Tower Guardrails
Correct answer: Service Control Policies (SCPs)
SCPs in AWS Organizations act as organizational-level guardrails that can restrict which AWS services and regions are accessible across all member accounts.
Question 5: What type of encryption protects data while it is being sent between a client and an AWS service over the network?
- Encryption at rest
- Encryption in transit (Correct answer)
- Client-side encryption
- Server-side encryption
Correct answer: Encryption in transit
Encryption in transit (typically TLS/SSL) protects data as it travels across networks between a client and server, preventing interception of data in motion.
Question 6: Which AWS service provides security recommendations across categories like cost optimization, performance, and security, including checks for open S3 buckets and MFA on the root account?
- AWS Security Hub
- AWS Config
- AWS Trusted Advisor (Correct answer)
- Amazon Inspector
Correct answer: AWS Trusted Advisor
AWS Trusted Advisor inspects your AWS environment and provides recommendations across five categories including security, such as flagging publicly accessible S3 buckets and missing MFA.
Question 7: A customer needs to run penetration tests against their own AWS infrastructure. What must they do first?
- Submit a formal request to AWS and wait for written approval before testing
- Penetration testing on your own AWS resources is permitted for allowed services without prior approval (Correct answer)
- Sign a non-disclosure agreement with AWS Security team
- Notify the AWS abuse team at least 30 days in advance
Correct answer: Penetration testing on your own AWS resources is permitted for allowed services without prior approval
AWS allows customers to perform penetration testing on their own resources for a set of permitted services (like EC2, RDS, and CloudFront) without prior approval, per the AWS Penetration Testing Policy.
CLF-C02 Security and Compliance 5
Which of the following is a security best practice for the AWS root account?