CLF-C02 Security & Compliance in the Cloud — Questions and Answers

Question 1: What is the shared responsibility model in AWS?

AWS is responsible for securing all customer data.
The customer is responsible for everything in the cloud.
AWS and the customer share different responsibilities based on services used (Correct answer)
Security is managed by third-party services only.

Correct answer: AWS and the customer share different responsibilities based on services used

The AWS Shared Responsibility Model defines security responsibilities between AWS and the customer. AWS is responsible for the security *of* the cloud, meaning the underlying infrastructure, while the customer is responsible for security *in* the cloud, which includes their data, applications, operating systems, and network configurations. This division ensures clarity and accountability for different aspects of cloud security.

Question 2: Which AWS service helps you manage access to AWS resources?

Amazon S3
AWS IAM (Correct answer)
AWS CloudWatch
Amazon EC2

Correct answer: AWS IAM

AWS Identity and Access Management (IAM) is the service specifically designed to help you securely manage access to AWS services and resources. It allows you to create and manage AWS users and groups, and use permissions to allow or deny their access to specific AWS resources. This ensures that only authorized individuals and services can interact with your cloud environment.

Question 3: What does AWS Shield protect against?

Internal data leaks
Phishing emails
DDoS attacks (Correct answer)
Lost passwords

Correct answer: DDoS attacks

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. It provides always-on detection and automatic inline mitigations that minimize application downtime and latency. AWS Shield offers two tiers: Standard, which is automatically included for all AWS customers, and Advanced, which provides enhanced protection and cost benefits.

Question 4: Which AWS service enables logging and monitoring?

Amazon SNS
AWS Lambda
AWS CloudTrail (Correct answer)
AWS RDS

Correct answer: AWS CloudTrail

AWS CloudTrail is an AWS service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and related events made by users, roles, or AWS services in your account and delivers log files to an Amazon S3 bucket. This allows you to track actions taken in your AWS environment, providing a detailed history for security analysis and troubleshooting.

Question 5: How does AWS support compliance?

By offering only one level of security.
Through AWS documentation.
Through compliance programs and certifications (Correct answer)
By limiting access to AWS services.

Correct answer: Through compliance programs and certifications

AWS supports compliance by adhering to numerous global, industry, and regulatory compliance programs and certifications. AWS regularly undergoes third-party audits to ensure its infrastructure and services meet stringent security and compliance standards. This commitment helps customers meet their own compliance obligations by building on a secure and compliant cloud platform.

Question 6: What does MFA stand for in cloud security?

Multiple File Access
Multi-Factor Authentication (Correct answer)
Mobile File Authorization
Managed File Access

Correct answer: Multi-Factor Authentication

MFA stands for Multi-Factor Authentication, a security best practice that adds an extra layer of protection beyond just a username and password. With MFA, users must provide two or more verification factors to gain access to an account. This significantly enhances security by making it much harder for unauthorized users to access an AWS account, even if they compromise a password.

Question 7: Which AWS feature helps enforce security policies?

EC2 Auto Scaling
SCPs in AWS Organizations (Correct answer)
AWS Elastic Beanstalk
S3 Replication

Correct answer: SCPs in AWS Organizations

Service Control Policies (SCPs) in AWS Organizations are a powerful feature that allows you to centrally manage permissions for all accounts in your organization. SCPs define the maximum available permissions for accounts, acting as guardrails to ensure that all member accounts adhere to your organization's security policies. They are crucial for enforcing security best practices across multiple AWS accounts.

Question 8: Which of the following is a security best practice in AWS?

Allow full admin access to everyone
Grant access to all services by default
Use least privilege principles (Correct answer)
Avoid using IAM roles

Correct answer: Use least privilege principles

Using the least privilege principle is a fundamental security best practice in AWS. This means granting users, roles, or services only the minimum permissions necessary to perform their required tasks, and no more. By limiting access, you reduce the potential impact of a compromised credential or malicious activity, significantly enhancing the overall security posture of your AWS environment.

Question 9: Which AWS service allows centralized management of security policies?

Amazon Aurora
AWS Organizations (Correct answer)
Amazon CloudFront
AWS WAF

Correct answer: AWS Organizations

AWS Organizations is the service that allows you to centrally manage and govern your environment as you grow and scale your AWS resources. It enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage. This includes applying security policies, such as Service Control Policies (SCPs), across all accounts from a single master account.

CLF-C02 Security & Compliance in the Cloud

What is the shared responsibility model in AWS?