CLF-C02 Security & Compliance in the Cloud 4

Question 1

Which AWS service is specifically designed to protect against large-scale Distributed Denial of Service (DDoS) attacks and is automatically available to all AWS customers at no extra cost?

Accepted Answer

AWS Shield Standard

Answer

AWS Shield Standard provides automatic protection against common and most frequently occurring DDoS attacks at no additional cost for all AWS customers.

Question 2

Which AWS service stores and rotates database credentials, API keys, and other secrets, eliminating the need to hardcode them in application code?

Accepted Answer

AWS Secrets Manager

Answer

AWS Secrets Manager securely stores, rotates, and manages access to secrets like database credentials and API keys throughout their lifecycle.

Question 3

In the Shared Responsibility Model, which of the following is AWS responsible for?

Accepted Answer

Maintaining physical data center security

Answer

AWS is responsible for the physical security of its data centers as part of managing the security 'of' the cloud.

Question 4

Which type of IAM policy is attached directly to an AWS resource, such as an S3 bucket, to control who can access it?

Accepted Answer

Resource-based policy

Answer

Resource-based policies are attached directly to resources like S3 buckets and define who (which principals) can perform actions on that resource.

Question 5

A company needs to meet PCI DSS compliance for processing credit card payments on AWS. Which AWS service helps them generate evidence and streamline compliance audits?

Accepted Answer

AWS Audit Manager

Answer

AWS Audit Manager continuously collects evidence and maps it to compliance frameworks like PCI DSS to simplify audit preparation.

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

(CLF-C02) AWS Certified Cloud Practitioner Practice Test

CLF-C02 Security & Compliance in the Cloud 4