Security Fundamentals — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Security and Compliance ·100 questions · 30 easy · 40 intermediate · 30 hard · page 1 of 7

Question 1 clf-security-fundamentals-001

Easy · Choose one

Under the AWS shared responsibility model, which task is the responsibility of AWS?

  1. a Deciding which employees receive permissions to an Amazon S3 bucket
  2. b Installing operating system security patches on an Amazon EC2 instance
  3. c Configuring the security group rules that control traffic to an Amazon EC2 instance
  4. d Protecting the physical facilities, hardware, and networking that run AWS Regions and Availability Zones
Show answer & explanation

Answer: D

Why D is correct

AWS describes its half of the model as security OF the cloud: the hardware, software, networking, and facilities that run AWS Cloud services, including Regions, Availability Zones, and edge locations. Anything the customer cannot physically reach or configure sits on the AWS side of the line.

Why the others are wrong

  • A — Identity and access management for the customer's own users and resources is squarely a customer responsibility; AWS provides IAM but never decides who in the customer's organization gets access.
  • B — Guest operating system patching on EC2 is explicitly named as a customer responsibility. AWS patches the underlying infrastructure, not the guest OS the customer launched.
  • C — Security groups are the AWS-provided firewall that the customer configures. AWS supplies the capability; deciding which ports and sources are allowed is security IN the cloud and belongs to the customer.

Last verified: 2026-08-28

Question 2 clf-security-fundamentals-002

Easy · Choose one

A company runs a web application on Amazon EC2 instances. Who is responsible for applying security patches to the guest operating system running on those instances?

  1. a AWS, but only for instances launched from AWS-published Amazon Machine Images
  2. b AWS, because AWS owns and maintains all software running in its data centers
  3. c Neither party, because Amazon EC2 instances are automatically patched by the hypervisor
  4. d The customer, because Amazon EC2 is an infrastructure service in which the customer manages the guest operating system
Show answer & explanation

Answer: D

Why D is correct

Amazon EC2 is categorized as Infrastructure as a Service, so the customer performs the security configuration and management tasks above the hypervisor. AWS states that customers who deploy an EC2 instance are responsible for management of the guest operating system, including updates and security patches, plus any software they install and the security group configuration.

Why the others are wrong

  • A — The source of the Amazon Machine Image does not change the boundary. AWS may publish an image, but once the instance is launched, keeping its operating system patched is the customer's job.
  • B — AWS maintains the software that runs the cloud infrastructure itself, such as the virtualization layer and the AWS service software, not the operating system inside a customer's instance.
  • C — The hypervisor isolates instances from one another; it does not reach inside a running instance to update its operating system packages.

Last verified: 2026-08-28

Question 3 clf-security-fundamentals-003

Easy · Select 2 answers

Which TWO tasks are the customer's responsibility under the AWS shared responsibility model? (Choose TWO.)

  1. a Managing IAM users, groups, roles, and their permissions
  2. b Configuring Amazon S3 bucket policies and access control settings
  3. c Maintaining physical access controls at Availability Zone facilities
  4. d Securely decommissioning storage devices at the end of their life
  5. e Applying security patches to the hypervisor that hosts Amazon EC2 instances
Show answer & explanation

Answer: A and B

Why A and B are correct

Both fall inside security IN the cloud. The customer decides who may reach their data, which is expressed through resource-based policies such as S3 bucket policies and through identity and access management. AWS supplies the mechanisms, but configuring them correctly is never delegated back to AWS.

Why the others are wrong

  • C — Physical and environmental security of AWS facilities is an inherited control, entirely on the AWS side of the model.
  • D — Media decommissioning is an AWS responsibility. AWS uses documented destruction processes for storage devices so that customer data cannot be recovered from retired hardware.
  • E — The hypervisor is part of the infrastructure AWS operates. Customers have no access to it and no ability to patch it.

Last verified: 2026-08-28

Question 4 clf-security-fundamentals-004

Intermediate · Choose one

AWS describes certain responsibilities as shared controls, which apply to both the infrastructure layer and the customer layer but in separate contexts. Which of the following is an example AWS gives of a shared control?

  1. a Zone security design for a customer's own application architecture
  2. b Physical and environmental controls at AWS data centers
  3. c Secure disposal of failed storage media in AWS facilities
  4. d Patch management, where AWS patches the underlying infrastructure and the customer patches guest operating systems and applications
Show answer & explanation

Answer: D

Why D is correct

A shared control is one where both parties carry out the same class of activity in different scopes. AWS names three: patch management, configuration management, and awareness and training. In each case AWS performs the control for its infrastructure and employees while the customer performs it for their own systems and staff.

Why the others are wrong

  • A — Zone security and service communications protection are what AWS calls customer specific controls, based solely on the application the customer deploys. AWS performs no counterpart.
  • B — Physical and environmental controls are an inherited control. The customer inherits them wholly from AWS and performs no part of them.
  • C — Media disposal is performed only by AWS. The customer has no equivalent activity because they never possess the hardware.

Last verified: 2026-08-28

Question 5 clf-security-fundamentals-005

Intermediate · Choose one

A company migrates a self-managed MySQL database from Amazon EC2 to Amazon RDS. Which responsibility shifts from the customer to AWS as a result of this migration?

  1. a Creating database user accounts and granting privileges within the database
  2. b Configuring which networks and instances may connect to the database
  3. c Patching the database engine software and the underlying operating system
  4. d Choosing whether to enable encryption at rest for the database
Show answer & explanation

Answer: C

Why C is correct

Amazon RDS is a managed service, and AWS states that it manages backups, software patching, automatic failure detection, and recovery. Moving up the abstraction ladder from EC2 to RDS transfers the undifferentiated maintenance of the engine and host to AWS while leaving the data and its access controls with the customer.

Why the others are wrong

  • A — Logins and privileges inside the database are managed with the database engine's own security features, which remain the customer's responsibility on Amazon RDS.
  • B — Network access to a DB instance is controlled by security groups and subnet placement, both configured by the customer.
  • D — Encryption at rest for an RDS DB instance is a customer choice and configuration. AWS provides the capability; the customer decides whether and how to apply it.

Last verified: 2026-08-28

Question 6 clf-security-fundamentals-006

Intermediate · Choose one

An application is built entirely on AWS Lambda. Under the shared responsibility model, which item remains the customer's responsibility?

  1. a Scaling the execution environment to match the incoming request rate
  2. b Publishing security updates for the managed language runtime
  3. c The security of the function code and the third-party dependencies it includes
  4. d Patching the operating system on the compute fleet that executes functions
Show answer & explanation

Answer: C

Why C is correct

AWS curates and publishes security updates for all supported managed runtimes and container base images, and applies runtime updates automatically for functions left in the default Auto runtime update mode. AWS states that in all cases the customer is responsible for applying updates to their function code, including its dependencies. Serverless removes infrastructure work; it never removes responsibility for the code the customer wrote or imported.

Why the others are wrong

  • A — Lambda scales the execution environment automatically in response to the request rate. AWS operates that mechanism, so it is not a customer maintenance responsibility, beyond optional concurrency settings the customer may choose to apply.
  • B — AWS explicitly takes responsibility for curating and publishing security updates for all supported managed runtimes and container base images.
  • D — For Lambda, AWS manages the underlying infrastructure, the operating system, and the application platform. The customer has no operating system to patch.

Last verified: 2026-08-28

Question 7 clf-security-fundamentals-007

Intermediate · Choose one

How does the division of responsibility change as a customer moves a workload from Amazon EC2 to an abstracted service such as Amazon S3?

  1. a AWS takes on the operating system and platform layers, and the customer's responsibility narrows to their data, access control, and encryption choices
  2. b The division does not change, because the shared responsibility model is identical for every AWS service
  3. c The customer takes on additional responsibility because abstracted services expose more configuration options
  4. d AWS takes on responsibility for classifying the customer's data and setting appropriate access controls
Show answer & explanation

Answer: A

Why A is correct

AWS states that for abstracted services such as Amazon S3 and Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and the platforms, and customers access endpoints to store and retrieve data. The customer's remaining duties concentrate on the content itself and who may reach it.

Why the others are wrong

  • B — AWS states directly that customer responsibility is determined by the AWS Cloud services the customer selects, so the boundary shifts by service.
  • C — Abstracted services reduce the customer's operational surface rather than expanding it; there is no operating system or platform left for the customer to manage.
  • D — Customer data and its classification never move to AWS. AWS states that customers own and control their content regardless of which service holds it.

Last verified: 2026-08-28

Question 8 clf-security-fundamentals-008

Hard · Choose one

An external auditor asks a company to identify a security control that it fully inherits from AWS and therefore does not need to test itself. Which control fits that description?

  1. a Physical and environmental controls at the data centers that host the company's workloads
  2. b Security awareness training for the company's own employees
  3. c Patch management for the guest operating systems on the company's Amazon EC2 instances
  4. d Configuration management of the company's applications and databases
Show answer & explanation

Answer: A

Why A is correct

AWS defines inherited controls as those a customer fully inherits from AWS, and names physical and environmental controls as the example. The customer performs no part of the control and can evidence it to an auditor using the AWS third-party attestation reports rather than testing it directly.

Why the others are wrong

  • B — Awareness and training is a shared control. AWS trains AWS employees; the customer must train its own, so this half is not inherited.
  • C — Patch management is a shared control. AWS patches the infrastructure, but the customer half named here, the guest operating systems, is performed by the customer and must be tested.
  • D — Configuration management is a shared control. AWS maintains the configuration of its infrastructure devices, while the customer configures its own operating systems, databases, and applications.

Last verified: 2026-08-28

Question 9 clf-security-fundamentals-009

Hard · Choose one

A company stores regulated data in Amazon S3 and enables server-side encryption with an AWS KMS customer managed key. Under the shared responsibility model, which task remains the company's responsibility?

  1. a Replicating objects across multiple Availability Zones to achieve the service's durability target
  2. b Classifying the data and defining the key policy and IAM permissions that govern who may use the key
  3. c Operating and maintaining the hardware security modules that protect the key material
  4. d Physically destroying storage media that has reached end of life
Show answer & explanation

Answer: B

Why B is correct

Encryption changes how data is protected, not who decides who may reach it. Data classification and the access controls around the key, meaning the key policy plus the IAM permissions of the callers, stay with the customer. A correctly encrypted object is still exposed if the key policy grants the wrong principal.

Why the others are wrong

  • A — Storage classes such as S3 Standard redundantly store objects across a minimum of three Availability Zones as part of the service AWS operates; the customer does not arrange this.
  • C — AWS KMS keys are generated and used inside hardware security modules that AWS operates and that are validated under FIPS 140-3 Security Level 3. Customers never operate that hardware.
  • D — Media destruction is performed by AWS as part of its infrastructure responsibilities and is an inherited control for the customer.

Last verified: 2026-08-28

Question 10 clf-security-fundamentals-010

Easy · Choose one

Which AWS service provides on-demand access to AWS compliance reports, such as SOC and PCI DSS reports?

  1. a AWS Artifact
  2. b AWS Config
  3. c AWS Trusted Advisor
  4. d AWS CloudTrail
Show answer & explanation

Answer: A

Why A is correct

AWS Artifact is the self-service portal for AWS security and compliance documentation. It supplies third-party audit artifacts such as SOC 1, SOC 2, SOC 3, ISO, and PCI DSS reports, and it also holds agreements a customer may need to accept with AWS. AWS provides these documents free of charge.

Why the others are wrong

  • B — AWS Config records and evaluates the configuration of a customer's own resources over time. It reports on the customer's compliance posture, not on AWS's audit attestations.
  • C — AWS Trusted Advisor inspects a customer's account against best-practice checks. It does not distribute AWS audit reports.
  • D — AWS CloudTrail records API activity in the customer's account for auditing and governance. It produces the customer's own audit trail rather than AWS's certifications.

Last verified: 2026-08-28

Question 11 clf-security-fundamentals-011

Easy · Choose one

A security team needs to determine which identity called a particular AWS API, from which IP address, and at what time. Which service records this information?

  1. a AWS Config
  2. b AWS CloudTrail
  3. c Amazon Inspector
  4. d Amazon CloudWatch
Show answer & explanation

Answer: B

Why B is correct

AWS CloudTrail enables operational and risk auditing, governance, and compliance by recording actions taken in an account as events. Each event captures the identity that made the request, the time, the source IP address, and the parameters, which is exactly the who-did-what record an investigation needs.

Why the others are wrong

  • A — AWS Config records what a resource's configuration is and how it has changed. It answers what changed, while CloudTrail answers who changed it.
  • C — Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not log API activity.
  • D — Amazon CloudWatch collects metrics, logs, and alarms about resource and application performance. It reports on how systems are behaving rather than which principal invoked an API.

Last verified: 2026-08-28

Question 12 clf-security-fundamentals-012

Easy · Choose one

A company must protect customer data while it travels between a user's browser and an Amazon CloudFront distribution. Which control addresses this requirement?

  1. a TLS encryption on the CloudFront distribution, using a certificate provisioned by AWS Certificate Manager
  2. b Amazon EBS encryption on the volumes attached to the Amazon EC2 instances that serve as the origin
  3. c Server-side encryption on the Amazon S3 bucket that stores the distribution's access logs
  4. d Encryption at rest on the Amazon RDS DB instance that the application queries
Show answer & explanation

Answer: A

Why A is correct

Data moving across a network needs encryption in transit, which on AWS means TLS. AWS Certificate Manager provisions the public certificate at no charge, deploys it to integrated services such as Amazon CloudFront and Amazon API Gateway, and renews it automatically before it expires. A certificate used with CloudFront must be requested in the US East (N. Virginia) Region.

Why the others are wrong

  • B — Amazon EBS encryption protects data at rest on the volume. It does nothing for traffic crossing the network to reach the distribution.
  • C — Encrypting the log bucket protects stored log files at rest. The user's request has already traversed the internet by the time a log entry is written.
  • D — Encryption at rest on Amazon RDS protects the stored database. The requirement described concerns the browser-to-load-balancer path, which is a different segment entirely.

Last verified: 2026-08-28

Question 13 clf-security-fundamentals-013

Intermediate · Choose one

An auditor asks a company to show exactly how a set of security groups was configured on a specific date eight months ago, and to list every configuration change since then. Which AWS service is designed to provide this?

  1. a AWS CloudTrail Event history in the console
  2. b AWS Trusted Advisor
  3. c Amazon CloudWatch metrics
  4. d AWS Config
Show answer & explanation

Answer: D

Why D is correct

AWS Config gives a detailed view of the configuration of AWS resources, including how they were configured in the past, so a customer can see how configurations and relationships change over time. Config rules can additionally evaluate whether each recorded configuration was compliant.

Why the others are wrong

  • A — CloudTrail Event history in the console retains only the past 90 days of management events per Region, so a state from eight months ago is no longer there. CloudTrail also records the API call rather than the resulting configuration state.
  • B — AWS Trusted Advisor reports on the current state of an account against best-practice checks. It does not maintain a configuration history.
  • C — Amazon CloudWatch metrics are time-series measurements of performance and utilization. They carry no record of a security group's rule set.

Last verified: 2026-08-28

Question 14 clf-security-fundamentals-014

Intermediate · Select 2 answers

Which TWO statements about AWS Artifact are correct? (Choose TWO.)

  1. a It continuously evaluates the customer's resource configurations against compliance rules
  2. b It issues a compliance certification for the customer's own application running on AWS
  3. c It provides AWS audit reports such as SOC and ISO reports at no charge
  4. d It aggregates security findings from Amazon GuardDuty and Amazon Inspector into a single view
  5. e It is where a customer reviews and accepts agreements with AWS, such as the Business Associate Addendum
Show answer & explanation

Answer: C and E

Why C and E are correct

AWS Artifact has two functions: on-demand download of AWS security and compliance documents, and management of agreements between the customer and AWS. AWS states that it provides these documents and agreements free of charge, and that a customer using AWS Organizations can accept an agreement such as a Business Associate Addendum on behalf of every account in the organization.

Why the others are wrong

  • A — Continuous evaluation of resource configurations against rules is what AWS Config does. Artifact is a document repository and does not inspect the customer's environment.
  • B — AWS notes that customers are responsible for developing or obtaining the documents that demonstrate their own security and compliance. Artifact attests to AWS, not to what the customer built on it.
  • D — Aggregating findings from other security services into one view is the role of AWS Security Hub, delivered today as AWS Security Hub CSPM.

Last verified: 2026-08-28

Question 15 clf-security-fundamentals-015

Intermediate · Choose one

What is true about server-side encryption of new objects uploaded to Amazon S3?

  1. a Server-side encryption must be requested on every individual upload request or the object is rejected
  2. b New objects are stored unencrypted unless the customer first enables default encryption on the bucket
  3. c Amazon S3 automatically applies server-side encryption with Amazon S3 managed keys to all new object uploads at no additional cost
  4. d Server-side encryption requires the customer to create and pay for an AWS KMS customer managed key
Show answer & explanation

Answer: C

Why C is correct

Since January 2023, all new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance. Server-side encryption with Amazon S3 managed keys, known as SSE-S3, is the base level of encryption applied to every bucket, using 256-bit AES-GCM.

Why the others are wrong

  • A — Specifying an encryption header on a request selects a particular encryption option. Omitting it does not cause a rejection; the object is encrypted using the bucket's default encryption configuration, which is SSE-S3 unless the bucket has been set to use SSE-KMS or DSSE-KMS.
  • B — This describes the behavior before the change. Default encryption no longer has to be switched on for new uploads to be encrypted.
  • D — A customer managed KMS key is one option, and it does carry a charge, but it is not required. The default SSE-S3 encryption uses keys that Amazon S3 manages at no cost.

Last verified: 2026-08-28