CLF-C02 Security & Compliance in the Cloud 5 — Questions and Answers
Question 1: Which AWS service allows you to centrally manage AWS WAF rules, Security Groups, and Shield Advanced protections across multiple accounts in an organization?
- AWS Security Hub
- AWS Firewall Manager (Correct answer)
- AWS Organizations
- Amazon GuardDuty
Correct answer: AWS Firewall Manager
AWS Firewall Manager lets you centrally configure and manage firewall rules, WAF policies, and Shield Advanced protections across all accounts in AWS Organizations.
Question 2: A company wants to verify that their AWS infrastructure changes never violate compliance rules in real time. Which service continuously monitors and records resource configurations?
- AWS CloudTrail
- AWS Config (Correct answer)
- Amazon CloudWatch
- AWS Systems Manager
Correct answer: AWS Config
AWS Config continuously monitors and records AWS resource configurations and evaluates them against desired compliance rules.
Question 3: Which AWS service enables federated identity, allowing users to sign in with corporate credentials (e.g., Active Directory) to access AWS resources?
- Amazon Cognito
- AWS Single Sign-On (IAM Identity Center) (Correct answer)
- AWS Directory Service
- AWS IAM
Correct answer: AWS Single Sign-On (IAM Identity Center)
AWS IAM Identity Center (formerly AWS SSO) enables federated access, allowing users to sign in with their corporate identity provider credentials to access AWS accounts.
Question 4: What does 'encryption at rest' mean in the context of AWS security?
- Data is encrypted while being transmitted over a network
- Data stored on disk or in a database is encrypted when not actively being used (Correct answer)
- Encryption keys are kept offline in a secure facility
- Applications pause encryption during maintenance windows
Correct answer: Data stored on disk or in a database is encrypted when not actively being used
Encryption at rest means that data stored on physical media (disks, databases, backups) is encrypted to protect it from unauthorized physical access.
Question 5: Which AWS service provides hardware security modules (HSMs) in the cloud to generate and manage your own encryption keys with exclusive single-tenant access?
- AWS Key Management Service (KMS)
- AWS CloudHSM (Correct answer)
- AWS Secrets Manager
- AWS Certificate Manager
Correct answer: AWS CloudHSM
AWS CloudHSM provides dedicated, single-tenant HSM appliances in the cloud, giving customers exclusive control over their cryptographic keys.
Question 6: A security team wants to analyze historical API activity across their AWS account to investigate a potential security incident. Which service provides this audit trail?
- Amazon CloudWatch Logs
- AWS CloudTrail (Correct answer)
- AWS Config
- Amazon GuardDuty
Correct answer: AWS CloudTrail
AWS CloudTrail records all API calls made in an AWS account, providing a complete audit trail for security investigations and compliance auditing.
Question 7: Which of the following is a customer responsibility under the AWS Shared Responsibility Model when using Amazon RDS?
- Patching the database engine software
- Managing the physical servers running RDS
- Configuring database user access controls and permissions (Correct answer)
- Maintaining the hypervisor layer
Correct answer: Configuring database user access controls and permissions
Customers are responsible for configuring database user access controls in RDS, while AWS manages the underlying infrastructure and database engine patching.
CLF-C02 Security & Compliance in the Cloud 5
Which AWS service allows you to centrally manage AWS WAF rules, Security Groups, and Shield Advanced protections across multiple accounts in an organization?