CLF-C02 Security & Compliance in the Cloud 3 — Questions and Answers
Question 1: Which encryption option allows Amazon S3 to manage the encryption keys on behalf of the customer?
- SSE-C
- SSE-KMS
- SSE-S3 (Correct answer)
- Client-side encryption
Correct answer: SSE-S3
SSE-S3 (Server-Side Encryption with S3-managed keys) lets S3 handle key management entirely on the customer's behalf.
Question 2: A developer accidentally committed AWS access keys to a public GitHub repository. What is the FIRST action they should take?
- Delete the GitHub repository
- Rotate or deactivate the compromised access keys immediately (Correct answer)
- Change their AWS account root email
- Enable MFA on their GitHub account
Correct answer: Rotate or deactivate the compromised access keys immediately
Immediately rotating or deactivating the exposed access keys prevents unauthorized use before any damage can be done.
Question 3: Which AWS service enables you to evaluate the security and compliance of your EC2 instances against predefined rules and best practices?
- AWS Audit Manager
- Amazon Inspector (Correct answer)
- AWS Config
- Amazon GuardDuty
Correct answer: Amazon Inspector
Amazon Inspector automatically assesses EC2 instances and container images for software vulnerabilities and unintended network exposure.
Question 4: What is the primary purpose of AWS Artifact?
- To store application deployment artifacts
- To provide on-demand access to AWS compliance reports and agreements (Correct answer)
- To automate security patching
- To manage SSL/TLS certificates
Correct answer: To provide on-demand access to AWS compliance reports and agreements
AWS Artifact is a self-service portal for on-demand access to AWS security and compliance reports such as SOC, PCI, and ISO certifications.
Question 5: Which principle states that users and systems should be granted only the minimum permissions necessary to perform their required tasks?
- Defense in depth
- Least privilege (Correct answer)
- Zero trust
- Separation of duties
Correct answer: Least privilege
The principle of least privilege means granting only the permissions needed to perform a specific task, reducing the attack surface.
Question 6: Which AWS service can automatically remediate non-compliant AWS resource configurations based on defined rules?
- Amazon GuardDuty
- AWS Config (Correct answer)
- AWS CloudTrail
- AWS Trusted Advisor
Correct answer: AWS Config
AWS Config can evaluate resource configurations against rules and trigger automated remediation actions for non-compliant resources.
Question 7: A company wants to protect their web application from common exploits like SQL injection and cross-site scripting. Which AWS service should they use?
- AWS Shield Standard
- AWS Network Firewall
- AWS WAF (Correct answer)
- Amazon VPC Security Groups
Correct answer: AWS WAF
AWS WAF (Web Application Firewall) filters HTTP/HTTPS traffic and protects against common web exploits like SQL injection and XSS.
CLF-C02 Security & Compliance in the Cloud 3
Which encryption option allows Amazon S3 to manage the encryption keys on behalf of the customer?