CLF-C02 Security & Compliance in the Cloud 2 — Questions and Answers
Question 1: Which AWS service provides a managed threat detection capability that analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify malicious activity?
- AWS Shield
- Amazon GuardDuty (Correct answer)
- AWS WAF
- Amazon Inspector
Correct answer: Amazon GuardDuty
Amazon GuardDuty is a managed threat detection service that continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify threats.
Question 2: A company needs to ensure that only approved AWS services can be used across all accounts in their organization. Which AWS service enables this policy enforcement?
- AWS IAM
- AWS Config
- AWS Organizations with Service Control Policies (Correct answer)
- AWS Security Hub
Correct answer: AWS Organizations with Service Control Policies
AWS Organizations with Service Control Policies (SCPs) allows you to centrally control the maximum permissions available to all accounts in your organization.
Question 3: Which AWS service helps customers discover, classify, and protect sensitive data such as PII stored in Amazon S3?
- Amazon Inspector
- AWS Secrets Manager
- Amazon Macie (Correct answer)
- AWS Shield
Correct answer: Amazon Macie
Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data like PII in Amazon S3.
Question 4: Under the AWS Shared Responsibility Model, patching the guest operating system on an Amazon EC2 instance is the responsibility of:
- AWS
- The customer (Correct answer)
- Both AWS and the customer equally
- The AWS Marketplace vendor
Correct answer: The customer
The customer is responsible for patching the guest OS on EC2 instances; AWS only manages the underlying infrastructure.
Question 5: Which feature of AWS IAM allows you to grant temporary security credentials to trusted entities without creating long-term IAM users?
- IAM Groups
- IAM Roles (Correct answer)
- IAM Policies
- IAM Access Analyzer
Correct answer: IAM Roles
IAM Roles provide temporary security credentials to trusted entities such as EC2 instances, Lambda functions, or federated users.
Question 6: What does the AWS penetration testing policy require customers to do before conducting penetration tests on their AWS environment?
- Submit a formal written request to AWS 30 days in advance
- No prior approval is required for tests on permitted services (Correct answer)
- Purchase AWS Shield Advanced
- Notify all other AWS customers in the same region
Correct answer: No prior approval is required for tests on permitted services
AWS no longer requires prior approval for penetration testing on a defined list of permitted services owned by the customer.
Question 7: Which AWS service provides a central location to manage security alerts and compliance status across multiple AWS accounts and services?
- AWS CloudTrail
- AWS Security Hub (Correct answer)
- Amazon CloudWatch
- AWS Trusted Advisor
Correct answer: AWS Security Hub
AWS Security Hub aggregates, organizes, and prioritizes security alerts and compliance findings from multiple AWS services and third-party tools.
CLF-C02 Security & Compliance in the Cloud 2
Which AWS service provides a managed threat detection capability that analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify malicious activity?