CLF-C02 Security & Compliance in the Cloud 2

Question 1

Which AWS service provides a managed threat detection capability that analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify malicious activity?

Accepted Answer

Amazon GuardDuty

Answer

Amazon GuardDuty is a managed threat detection service that continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify threats.

Question 2

A company needs to ensure that only approved AWS services can be used across all accounts in their organization. Which AWS service enables this policy enforcement?

Accepted Answer

AWS Organizations with Service Control Policies

Answer

AWS Organizations with Service Control Policies (SCPs) allows you to centrally control the maximum permissions available to all accounts in your organization.

Question 3

Which AWS service helps customers discover, classify, and protect sensitive data such as PII stored in Amazon S3?

Accepted Answer

Amazon Macie

Answer

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data like PII in Amazon S3.

Question 4

Under the AWS Shared Responsibility Model, patching the guest operating system on an Amazon EC2 instance is the responsibility of:

Accepted Answer

The customer

Answer

The customer is responsible for patching the guest OS on EC2 instances; AWS only manages the underlying infrastructure.

Question 5

Which feature of AWS IAM allows you to grant temporary security credentials to trusted entities without creating long-term IAM users?

Accepted Answer

IAM Roles

Answer

IAM Roles provide temporary security credentials to trusted entities such as EC2 instances, Lambda functions, or federated users.

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

CLF-C02 Security & Compliance in the Cloud 2