Learn730 Get the Android app

CLF-C02 Security and Compliance Practice Questions

Fifteen practice questions for Domain 2 of the AWS Certified Cloud Practitioner (CLF-C02) exam. Choose an answer to check it, then read why each wrong option is wrong.

Security and Compliance is about 30% of the scored exam content, the second-largest domain after Cloud Technology and Services.

Practice all 200 questions in your browser Get the Android app
15 questions

Practice questions

1 Shared responsibility model: Amazon EC2

A company runs its application on Amazon EC2 instances. Which task is the customer's responsibility under the AWS shared responsibility model?

  1. Option A: Physical security of the data center where the instances run
  2. Option B: Patching the guest operating system on the instances
  3. Option C: Maintaining the hypervisor that runs the instances
  4. Option D: Replacing failed host hardware

Show answer and explanation

Answer: B. With EC2, AWS secures the infrastructure from the facility and hardware up through the virtualization layer. The customer manages everything from the guest operating system up: OS patches, installed software, security group rules, and data.

Why the other options are wrong

  • A. Physical security of AWS facilities is part of security of the cloud, which AWS owns.
  • C. AWS operates and secures the hypervisor.
  • D. AWS maintains and replaces the underlying hardware.

2 Shared responsibility model: Amazon S3

A company stores customer files in Amazon S3. Which task is the customer's responsibility?

  1. Option A: Replacing failed storage drives in AWS data centers
  2. Option B: Patching the software that runs the S3 service
  3. Option C: Controlling who can access the buckets and objects through policies and permissions
  4. Option D: Securing the network between AWS data centers

Show answer and explanation

Answer: C. S3 is a managed service, so AWS runs the infrastructure and the service itself. The customer is still responsible for their data and for access control: bucket policies, IAM permissions, and choices about encryption and public access.

Why the other options are wrong

  • A. Hardware and storage media are AWS's responsibility.
  • B. AWS patches and maintains the S3 service software.
  • D. AWS secures its global network infrastructure.

3 Securing the root user

A company has just created a new AWS account. Which action should the company take first to help secure the account's root user?

  1. Option A: Create access keys for the root user and store them in the application code
  2. Option B: Enable multi-factor authentication (MFA) on the root user
  3. Option C: Share the root user password with the operations team
  4. Option D: Use the root user for daily administrative tasks

Show answer and explanation

Answer: B. The root user has unrestricted access to the account. Enable MFA on it, avoid using it for everyday work, and create IAM users or use IAM Identity Center for administrators instead. Keep root for the few tasks that require it.

Why the other options are wrong

  • A. Root access keys embedded in code are a serious risk. Best practice is not to create root access keys at all.
  • C. Sharing root credentials removes accountability and widens exposure of the most powerful identity in the account.
  • D. Daily work should use least-privilege IAM identities, not root.

4 IAM groups

A company hires 20 developers who all need the same permissions. What is the MOST efficient way to manage their access?

  1. Option A: Attach the same policy to each of the 20 IAM users individually
  2. Option B: Add the users to an IAM group and attach the policy to the group
  3. Option C: Create one shared IAM user and give the credentials to all developers
  4. Option D: Give the developers the root user credentials

Show answer and explanation

Answer: B. An IAM group lets you manage permissions for many users at once. When someone joins or leaves the team, you change group membership instead of editing policies user by user.

Why the other options are wrong

  • A. This works but does not scale and is easy to get inconsistent.
  • C. A shared user removes individual accountability and makes auditing impossible.
  • D. Root credentials must never be shared.

5 IAM roles for applications

An application running on an Amazon EC2 instance needs to read objects from an Amazon S3 bucket. What is the MOST secure way to give it access?

  1. Option A: Store an IAM user's access keys in the application's configuration file
  2. Option B: Attach an IAM role to the EC2 instance
  3. Option C: Use the AWS account root user's access keys
  4. Option D: Make the S3 bucket public

Show answer and explanation

Answer: B. An IAM role attached to the instance gives the application temporary credentials that AWS rotates automatically. There are no long-term secrets to store, leak, or rotate by hand.

Why the other options are wrong

  • A. Long-term access keys in a config file can leak and must be rotated manually.
  • C. Root keys give unrestricted access and should not exist, let alone be used by an application.
  • D. A public bucket exposes the data to everyone, not just the application.

6 Security groups

Which AWS feature acts as a stateful virtual firewall that controls inbound and outbound traffic at the Amazon EC2 instance level?

  1. Option A: Security group
  2. Option B: Network ACL
  3. Option C: AWS WAF
  4. Option D: AWS Shield

Show answer and explanation

Answer: A. Security groups are stateful: if inbound traffic is allowed, the response is automatically allowed out, and the reverse. They attach to instances (network interfaces) and contain allow rules only.

Why the other options are wrong

  • B. Network ACLs are stateless and apply at the subnet level.
  • C. AWS WAF filters HTTP and HTTPS requests to web applications. It is not an instance-level firewall.
  • D. AWS Shield protects against DDoS attacks.

7 DDoS protection

Which AWS service automatically provides protection against common DDoS attacks for all AWS customers at no additional cost?

  1. Option A: AWS Shield Standard
  2. Option B: AWS WAF
  3. Option C: Amazon GuardDuty
  4. Option D: AWS Firewall Manager

Show answer and explanation

Answer: A. AWS Shield Standard is enabled automatically for every AWS customer. Shield Advanced is the paid tier with additional protections and support.

Why the other options are wrong

  • B. AWS WAF is a separate service, charged by usage, that filters web requests.
  • C. GuardDuty detects threats. It is not a DDoS mitigation service.
  • D. Firewall Manager centrally manages firewall rules across accounts. It does not provide DDoS protection by itself.

8 AWS WAF

A company hosts a web application behind an Application Load Balancer and wants to block common web exploits such as SQL injection and cross-site scripting. Which service should the company use?

  1. Option A: AWS WAF
  2. Option B: AWS Artifact
  3. Option C: Amazon Inspector
  4. Option D: AWS Key Management Service (AWS KMS)

Show answer and explanation

Answer: A. AWS WAF inspects incoming web requests and blocks or allows them using rules, including managed rules for common exploits like SQL injection and cross-site scripting. It integrates with Application Load Balancer, Amazon CloudFront, and Amazon API Gateway.

Why the other options are wrong

  • B. AWS Artifact provides compliance reports and agreements. It does not filter traffic.
  • C. Amazon Inspector scans workloads for vulnerabilities. It does not block requests.
  • D. AWS KMS manages encryption keys.

9 Threat detection

Which AWS service continuously monitors accounts and workloads for malicious activity by analyzing sources such as AWS CloudTrail events, VPC Flow Logs, and DNS logs?

  1. Option A: Amazon GuardDuty
  2. Option B: Amazon Inspector
  3. Option C: Amazon Macie
  4. Option D: AWS Trusted Advisor

Show answer and explanation

Answer: A. Amazon GuardDuty is a threat detection service. It uses machine learning, anomaly detection, and threat intelligence to flag suspicious behavior such as compromised instances or unusual API calls.

Why the other options are wrong

  • B. Inspector looks for software vulnerabilities and unintended network exposure.
  • C. Macie discovers sensitive data in Amazon S3.
  • D. Trusted Advisor checks your account against best practices for cost, performance, security, fault tolerance, and service limits.

10 Sensitive data discovery

A company needs to automatically discover personally identifiable information (PII) stored in Amazon S3 buckets. Which service meets this requirement?

  1. Option A: Amazon Macie
  2. Option B: Amazon GuardDuty
  3. Option C: AWS Shield
  4. Option D: AWS Config

Show answer and explanation

Answer: A. Amazon Macie uses machine learning and pattern matching to discover and report sensitive data, such as PII, in Amazon S3, and it flags buckets with risky security settings.

Why the other options are wrong

  • B. GuardDuty detects threats and suspicious activity, not sensitive data content.
  • C. Shield protects against DDoS attacks.
  • D. AWS Config records resource configuration changes and evaluates them against rules. It does not scan data contents.

11 Vulnerability scanning

Which AWS service automatically scans Amazon EC2 instances and container images for software vulnerabilities and unintended network exposure?

  1. Option A: Amazon Inspector
  2. Option B: Amazon Macie
  3. Option C: AWS CloudTrail
  4. Option D: AWS Artifact

Show answer and explanation

Answer: A. Amazon Inspector is an automated vulnerability management service. It scans EC2 instances, container images in Amazon ECR, and AWS Lambda functions.

Why the other options are wrong

  • B. Macie finds sensitive data in S3, not software vulnerabilities.
  • C. CloudTrail records API activity.
  • D. Artifact provides compliance documents.

12 Compliance reports

An auditor asks a company for AWS's SOC reports and ISO certifications. Where can the company download these on demand?

  1. Option A: AWS Artifact
  2. Option B: AWS Config
  3. Option C: AWS Trusted Advisor
  4. Option D: AWS CloudTrail

Show answer and explanation

Answer: A. AWS Artifact is the self-service portal for AWS compliance reports (such as SOC reports) and certifications, and for reviewing and accepting agreements.

Why the other options are wrong

  • B. AWS Config tracks the configuration of the company's own resources.
  • C. Trusted Advisor gives best-practice recommendations for the account.
  • D. CloudTrail logs API activity in the account.

13 Auditing API activity

A security team needs to find out which user deleted an Amazon S3 bucket, and when. Which service provides this record?

  1. Option A: AWS CloudTrail
  2. Option B: Amazon CloudWatch
  3. Option C: AWS Config
  4. Option D: AWS Trusted Advisor

Show answer and explanation

Answer: A. AWS CloudTrail records API calls made in your account, including who made the call, when, and from where. That is the audit trail for questions about who did what.

Why the other options are wrong

  • B. CloudWatch collects metrics, logs, and alarms for monitoring performance and operations. It is not the record of who made an API call.
  • C. AWS Config records what a resource's configuration was and how it changed, but CloudTrail is the source for who made the API call.
  • D. Trusted Advisor provides best-practice checks, not an activity log.

14 Encryption keys

Which AWS service lets a company create and control the cryptographic keys used to encrypt its data?

  1. Option A: AWS Key Management Service (AWS KMS)
  2. Option B: AWS Certificate Manager
  3. Option C: Amazon Cognito
  4. Option D: AWS Shield

Show answer and explanation

Answer: A. AWS KMS creates and manages cryptographic keys and controls their use across AWS services and applications. Many services, including Amazon S3, EBS, and RDS, integrate with it for encryption.

Why the other options are wrong

  • B. AWS Certificate Manager provisions and manages TLS certificates, not data encryption keys.
  • C. Amazon Cognito handles user sign-up and sign-in for applications.
  • D. Shield protects against DDoS attacks.

15 IAM best practices (select two)

Which TWO actions are IAM security best practices? (Select TWO.)

  1. Option A: Grant only the permissions required to perform a task (least privilege)
  2. Option B: Share access keys among team members so everyone can run the same scripts
  3. Option C: Enable MFA for the root user and for IAM users with sensitive permissions
  4. Option D: Use the root user for daily administrative work
  5. Option E: Embed long-term access keys in application source code

Show answer and explanation

Answer: A and C. Least privilege limits the damage from mistakes or compromised credentials, and MFA adds a second factor that protects accounts even if a password is stolen.

Why the other options are wrong

  • B. Shared keys destroy accountability and make it impossible to trace actions to one person.
  • D. Root should be reserved for the few tasks that require it.
  • E. Keys in source code are easily leaked, for example through a public repository. Use IAM roles for temporary credentials instead.

What Domain 2 covers on the CLF-C02

Shared responsibility model

AWS is responsible for security of the cloud (facilities, hardware, and the software that runs its services). The customer is responsible for security in the cloud (data, identities, access, and configuration). The split shifts by service: you patch the guest OS on Amazon EC2, but AWS patches the underlying platform for a managed service like Amazon RDS.

Security, governance, and compliance concepts

Know where to find compliance evidence (AWS Artifact), how encryption at rest and in transit works, and how logging and auditing work (AWS CloudTrail, Amazon CloudWatch, AWS Config).

Access management

IAM users, groups, roles, and policies; the root user and MFA; least privilege; temporary credentials; and single sign-on with AWS IAM Identity Center.

Security components and resources

Security groups and network ACLs, AWS WAF, AWS Shield, Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Security Hub, AWS KMS, and AWS Secrets Manager. The exam usually tests whether you can match a requirement to the right service.

How to use these questions

Answer before you read the explanation. For every miss, read why the tempting wrong option is wrong, since that is how the real exam separates similar services (for example GuardDuty versus Inspector, or CloudTrail versus Config).

Practice the other domains

The exam covers four domains. See all CLF-C02 practice questions by domain, or continue with one of these:

Keep practicing

Learn730 has 200 CLF-C02 practice questions across all four domains, 134 flashcards, and a beginner Cloud 101 section. A timed simulation exam is coming.

Open in your browser Get the Android app