CLF-C02 Security & Compliance in the Cloud 4 — Questions and Answers
Question 1: Which AWS service is specifically designed to protect against large-scale Distributed Denial of Service (DDoS) attacks and is automatically available to all AWS customers at no extra cost?
- AWS WAF
- AWS Shield Advanced
- AWS Shield Standard (Correct answer)
- Amazon Route 53
Correct answer: AWS Shield Standard
AWS Shield Standard provides automatic protection against common and most frequently occurring DDoS attacks at no additional cost for all AWS customers.
Question 2: Which AWS service stores and rotates database credentials, API keys, and other secrets, eliminating the need to hardcode them in application code?
- AWS Key Management Service
- AWS Systems Manager Parameter Store
- AWS Secrets Manager (Correct answer)
- AWS Certificate Manager
Correct answer: AWS Secrets Manager
AWS Secrets Manager securely stores, rotates, and manages access to secrets like database credentials and API keys throughout their lifecycle.
Question 3: In the Shared Responsibility Model, which of the following is AWS responsible for?
- Configuring security groups
- Encrypting customer data at rest
- Maintaining physical data center security (Correct answer)
- Managing IAM user permissions
Correct answer: Maintaining physical data center security
AWS is responsible for the physical security of its data centers as part of managing the security 'of' the cloud.
Question 4: Which type of IAM policy is attached directly to an AWS resource, such as an S3 bucket, to control who can access it?
- Identity-based policy
- Resource-based policy (Correct answer)
- Permissions boundary
- Session policy
Correct answer: Resource-based policy
Resource-based policies are attached directly to resources like S3 buckets and define who (which principals) can perform actions on that resource.
Question 5: A company needs to meet PCI DSS compliance for processing credit card payments on AWS. Which AWS service helps them generate evidence and streamline compliance audits?
- AWS Security Hub
- AWS Audit Manager (Correct answer)
- AWS Config
- Amazon Macie
Correct answer: AWS Audit Manager
AWS Audit Manager continuously collects evidence and maps it to compliance frameworks like PCI DSS to simplify audit preparation.
Question 6: Which AWS IAM best practice helps protect the root account from unauthorized access?
- Create multiple root accounts for redundancy
- Enable Multi-Factor Authentication (MFA) on the root account (Correct answer)
- Share root credentials with the security team
- Use root credentials for daily administrative tasks
Correct answer: Enable Multi-Factor Authentication (MFA) on the root account
Enabling MFA on the root account is a critical best practice that adds an additional layer of protection against unauthorized access.
Question 7: Which AWS service provides managed DDoS protection with 24/7 access to the AWS DDoS Response Team (DRT) and cost protection?
- AWS Shield Standard
- AWS WAF
- AWS Shield Advanced (Correct answer)
- AWS Firewall Manager
Correct answer: AWS Shield Advanced
AWS Shield Advanced is the paid tier that provides enhanced DDoS protection, access to the DRT, and financial protections against DDoS-related scaling costs.
CLF-C02 Security & Compliance in the Cloud 4
Which AWS service is specifically designed to protect against large-scale Distributed Denial of Service (DDoS) attacks and is automatically available to all AWS customers at no extra cost?