CLF-C02 Security and Compliance 5

Question 1

Which of the following is a security best practice for the AWS root account?

Accepted Answer

Enable MFA and avoid using the root account for routine tasks

Answer

AWS best practice is to enable MFA on the root account and use it only for tasks that absolutely require root access, performing all other work with IAM users or roles.

Question 2

A company wants to protect sensitive database passwords and API keys used by their applications, with automatic rotation. Which AWS service is BEST suited for this?

Accepted Answer

AWS Secrets Manager

Answer

AWS Secrets Manager is designed to store, manage, and automatically rotate secrets like database credentials and API keys, with built-in integration for RDS and other services.

Question 3

In the AWS Shared Responsibility Model, which of the following is a responsibility shared between AWS and the customer?

Accepted Answer

Encryption of data at rest and in transit

Answer

Encryption is a shared responsibility — AWS provides encryption tools and services, but the customer is responsible for deciding to enable encryption and managing their own keys.

Question 4

Which feature of AWS Organizations helps centrally manage and enforce consistent security policies such as restricting specific AWS regions across all member accounts?

Accepted Answer

Service Control Policies (SCPs)

Answer

SCPs in AWS Organizations act as organizational-level guardrails that can restrict which AWS services and regions are accessible across all member accounts.

Question 5

What type of encryption protects data while it is being sent between a client and an AWS service over the network?

Accepted Answer

Encryption in transit

Answer

Encryption in transit (typically TLS/SSL) protects data as it travels across networks between a client and server, preventing interception of data in motion.

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

CLF-C02 Security and Compliance 5