Security Fundamentals — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Security and Compliance ·100 questions · 30 easy · 40 intermediate · 30 hard · page 2 of 7

Question 16 clf-security-fundamentals-016

Intermediate · Choose one

A European company must ensure that its customer content is stored only in AWS Regions within the European Union. Which statement reflects the AWS position on where customer content is stored?

  1. a The customer chooses the Regions, and AWS will not move or replicate content outside them except as needed to provide services the customer initiated or to comply with law
  2. b AWS selects the Region for each customer based on the billing address on the account
  3. c AWS automatically replicates content to the geographically nearest Region to improve durability
  4. d Content stored in a European Region is automatically copied to a Region on another continent for disaster recovery
Show answer & explanation

Answer: A

Why A is correct

AWS states that customers own their content and choose the AWS Regions in which it is stored, and that AWS will not move or replicate content outside the chosen Regions except as necessary to provide the services the customer initiated or to comply with law or a binding order of a governmental body. Region selection is therefore the primary control for data residency requirements.

Why the others are wrong

  • B — Region selection is made by the customer for each resource. Billing details have no bearing on where data is placed.
  • C — AWS does not silently replicate customer content to other Regions. Cross-Region copying happens only when the customer configures it, for example with S3 Cross-Region Replication.
  • D — Cross-Region disaster recovery is something the customer designs and enables. Amazon S3 achieves its durability target within a single Region, with most storage classes storing objects across at least three Availability Zones; the One Zone classes are the exception.

Last verified: 2026-08-28

Question 17 clf-security-fundamentals-017

Hard · Choose one

A security analyst opens CloudTrail Event history in the AWS Management Console and cannot find a management event that occurred eight months ago. What is the most likely explanation?

  1. a Event history is available only in the AWS Organizations management account, so member account events are not shown
  2. b CloudTrail deletes an event once the AWS resource it refers to has been terminated
  3. c CloudTrail records data events by default, and management events must be enabled separately
  4. d Event history retains only the past 90 days of management events per Region, and longer retention requires a trail or CloudTrail Lake event data store
Show answer & explanation

Answer: D

Why D is correct

CloudTrail Event history provides a viewable, searchable, downloadable, and immutable record of the past 90 days of management events in an AWS Region, at no charge. To keep events beyond that window, a customer creates a trail that delivers events to Amazon S3 or configures a CloudTrail Lake event data store with a longer retention period.

Why the others are wrong

  • A — Event history is available in every account and Region. Organization-wide aggregation is a feature of organization trails, not a limitation on the console view.
  • B — Events are an immutable record of the API activity itself. Deleting the resource does not remove the history of calls made against it.
  • C — The relationship is the reverse. Management events are recorded by default, while data events are high-volume and must be explicitly enabled, usually with additional cost.

Last verified: 2026-08-28

Question 18 clf-security-fundamentals-018

Hard · Choose one

A company enables Amazon GuardDuty. Which data sources does GuardDuty use as its foundational data sources, requiring no additional protection plan to be analyzed?

  1. a AWS Config configuration items and AWS CloudTrail management events
  2. b Amazon CloudWatch metrics and application logs collected by the CloudWatch agent
  3. c AWS CloudTrail management events, VPC Flow Logs, and DNS logs
  4. d Amazon S3 data events, VPC Flow Logs, and DNS logs
Show answer & explanation

Answer: C

Why C is correct

These three are GuardDuty's foundational data sources. AWS states that nothing else needs to be enabled for GuardDuty to start analyzing and processing them, and that GuardDuty accesses them at no additional cost from AWS CloudTrail, Amazon VPC, and Route 53, so the customer does not have to activate or pay for those logs separately. GuardDuty's own foundational charges are based on the volume of events and logs it analyzes.

Why the others are wrong

  • A — AWS Config records resource configuration state and is not a GuardDuty data source. GuardDuty is a threat detection service driven by activity logs.
  • B — CloudWatch metrics and agent-collected application logs are monitoring telemetry. GuardDuty draws on account, network, and DNS activity instead.
  • D — Amazon S3 data events are not a foundational data source. They are analyzed by the S3 Protection plan, which is one of several protection plans billed separately from the foundational sources, although GuardDuty does turn S3 Protection on automatically when it is first enabled in a Region.

Last verified: 2026-08-28

Question 19 clf-security-fundamentals-019

Hard · Choose one

A security team wants one place to view findings produced by Amazon GuardDuty, Amazon Inspector, and Amazon Macie, and to measure the environment against the AWS Foundational Security Best Practices standard. Which service is designed for this?

  1. a Amazon CloudWatch
  2. b AWS Config
  3. c AWS Security Hub
  4. d Amazon Detective
Show answer & explanation

Answer: C

Why C is correct

This capability is delivered today as AWS Security Hub CSPM, which gives a comprehensive view of security state in AWS, receives findings from services such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie, and assesses the environment against standards including AWS Foundational Security Best Practices, CIS, PCI DSS, and NIST. AWS split the original service in 2025: what was previously known as Security Hub is now Security Hub CSPM, while a newer AWS Security Hub correlates those findings into prioritized exposures. The certification's in-scope services list still names it AWS Security Hub.

Why the others are wrong

  • A — Amazon CloudWatch collects metrics, logs, and alarms for operational monitoring, not consolidated security findings and compliance standard scores.
  • B — AWS Config evaluates resource configurations against rules and conformance packs. It does not ingest findings from GuardDuty, Inspector, or Macie.
  • D — Amazon Detective analyzes and investigates findings to identify root cause. It works on findings after they exist rather than aggregating them and scoring the environment against standards.

Last verified: 2026-08-28

Question 20 clf-security-fundamentals-020

Hard · Choose one

Amazon GuardDuty raises a finding that an Amazon EC2 instance is communicating with a known command-and-control server. The team must now determine the root cause by examining related API activity and how the affected resources behaved over the preceding weeks. Which service is purpose-built for this investigation?

  1. a Amazon Macie
  2. b Amazon Detective
  3. c Amazon Inspector
  4. d AWS Certificate Manager
Show answer & explanation

Answer: B

Why B is correct

Amazon Detective helps analyze, investigate, and quickly identify the root cause of security findings or suspicious activity. It builds a behavior graph from CloudTrail management events, VPC Flow Logs, EKS audit logs, and GuardDuty findings, and applies machine learning, statistical analysis, and graph theory to visualize how resources interacted over time.

Why the others are wrong

  • A — Amazon Macie discovers sensitive data in Amazon S3. It has no role in reconstructing the activity behind a threat finding.
  • C — Amazon Inspector is a vulnerability management service. It reports which software flaws and network exposures exist, not how an incident unfolded.
  • D — AWS Certificate Manager provisions and renews TLS certificates. It performs no security investigation function.

Last verified: 2026-08-28

Question 21 clf-security-fundamentals-021

Easy · Choose one

What does the principle of least privilege mean when applied to AWS access management?

  1. a Using the account root user only for administrative work and never for daily tasks
  2. b Granting AWS access to as few people in the organization as possible
  3. c Placing every user in one IAM group so that permissions are managed in a single place
  4. d Granting an identity only the permissions required to perform its task, and nothing more
Show answer & explanation

Answer: D

Why D is correct

Least privilege is about the scope of each grant rather than the number of people who hold one. It means granting only the actions, resources, and conditions a task genuinely requires. AWS notes that a team may begin with broader permissions while it learns what a workload needs, then reduce them over time, using signals such as IAM last accessed information to remove permissions that were never used.

Why the others are wrong

  • A — Restricting root user use is a separate and valid best practice, but least privilege applies to every identity in the account, not only the root user.
  • B — Limiting headcount is not the same idea. Ten people with correctly scoped permissions is a better security posture than two people who each hold administrator access.
  • C — Consolidating everyone into a single group forces one permission set on people with different jobs, which is the opposite of least privilege.

Last verified: 2026-08-28

Question 22 clf-security-fundamentals-022

Easy · Choose one

Which control adds a second factor of authentication to AWS Management Console sign-in?

  1. a An IAM password policy that requires a minimum length and character complexity
  2. b Multi-factor authentication using a passkey, a security key, or an authenticator application
  3. c A resource-based policy attached to the resources the user needs
  4. d An access key ID and secret access key pair issued to the user
Show answer & explanation

Answer: B

Why B is correct

Multi-factor authentication requires something the user knows, their password, plus something they have, an authenticator device. AWS supports passkeys and FIDO security keys, virtual authenticator applications, and hardware time-based one-time password tokens, and an identity can register up to eight MFA devices.

Why the others are wrong

  • A — A password policy strengthens the first factor. A longer, more complex password is still a single factor, so a stolen password still grants access.
  • C — A resource-based policy governs what a principal is authorized to do once identified. It plays no part in proving who the principal is.
  • D — Access keys are long-term credentials for programmatic access through the AWS CLI and SDKs. They are an alternative credential type, not a second factor for console sign-in.

Last verified: 2026-08-28

Question 23 clf-security-fundamentals-023

Easy · Choose one

Which IAM identity provides temporary security credentials and has no long-term password or access keys of its own?

  1. a An IAM group
  2. b An IAM user
  3. c The AWS account root user
  4. d An IAM role
Show answer & explanation

Answer: D

Why D is correct

AWS states that a role does not have standard long-term credentials such as a password or access keys. When an identity assumes a role it receives temporary security credentials for that role session, which expire automatically. This is why roles are the recommended way to grant access to applications, AWS services, and federated users.

Why the others are wrong

  • A — An IAM group is a container used to attach permissions to a collection of users. It is not an identity, cannot be signed in to, and cannot be named as a principal in a policy.
  • B — An IAM user is an identity with long-term credentials, which may include a console password and access keys. Those credentials persist until someone rotates or deletes them.
  • C — The root user has long-term credentials, specifically the account email address and password, and holds unrestricted access to the account.

Last verified: 2026-08-28

Question 24 clf-security-fundamentals-024

Easy · Select 2 answers

Which TWO practices does AWS recommend for protecting the AWS account root user? (Choose TWO.)

  1. a Enable multi-factor authentication on the root user
  2. b Share the root user credentials with each administrator so that any of them can respond to an incident
  3. c Attach an IAM policy to the root user that restricts it to read-only actions
  4. d Use the root user for routine daily administration so that all privileged activity is recorded under one identity
  5. e Avoid creating access keys for the root user, and delete any that already exist
Show answer & explanation

Answer: A and E

Why A and E are correct

The root user holds unrestricted access that cannot be limited by an identity-based policy, so protection focuses on making the credentials hard to misuse and rarely needed. AWS strongly recommends enabling MFA, and recommends against creating root access keys because programmatic access with unrestricted permissions is a severe risk if the keys leak. MFA is now required for the root user across all AWS account types.

Why the others are wrong

  • B — Sharing credentials destroys accountability, since CloudTrail can only record that the root user acted and not which person did so. AWS instead suggests controls such as multi-person approval, where no single person holds both the password and the MFA device.
  • C — Identity-based policies cannot restrict the root user, which is why AWS focuses on credential protection and on centralized root access management in AWS Organizations rather than on limiting root with a policy.
  • D — AWS advises not to access the root user unless a task genuinely requires it, and to perform daily work with IAM roles or IAM Identity Center workforce users.

Last verified: 2026-08-28

Question 25 clf-security-fundamentals-025

Intermediate · Choose one

A company has 200 developers who all require exactly the same set of permissions. What is the most maintainable way to grant those permissions?

  1. a Create 200 IAM roles, one for each developer, and attach the policy to every role
  2. b Create an IAM group, attach the permissions policy to the group, and add the developers to that group
  3. c Attach the permissions policy directly to each of the 200 IAM users
  4. d Add the permissions policy to the account root user and share those credentials with the developers
Show answer & explanation

Answer: B

Why B is correct

An IAM group is a collection of users that permissions can be attached to as a unit. Changing the group policy updates every member at once, and joiners and leavers are handled by group membership alone, which keeps the permission model consistent and auditable as the team changes.

Why the others are wrong

  • A — Roles are for identities that assume them temporarily, such as applications or federated users. Creating one role per person reproduces the maintenance problem rather than solving it.
  • C — Attaching the same policy 200 times creates 200 places to update. Any policy change risks leaving some users out of step with the rest.
  • D — Root user credentials cannot be restricted by a policy and must never be shared. This would give every developer unrestricted access to the account.

Last verified: 2026-08-28

Question 26 clf-security-fundamentals-026

Intermediate · Choose one

An IAM user belongs to a group whose policy allows s3:DeleteObject. A separate policy attached directly to that user explicitly denies s3:DeleteObject. What happens when the user tries to delete an object?

  1. a The request is allowed, because policies attached to a group take precedence over policies attached to a user
  2. b The request is denied only if the S3 bucket policy also denies the action
  3. c The request is denied, because an explicit deny overrides any allow
  4. d The request is allowed, because the most recently attached policy is evaluated last and wins
Show answer & explanation

Answer: C

Why C is correct

IAM evaluates all applicable policies together and applies a fixed order of precedence: an explicit deny always wins, otherwise an explicit allow is required, and anything not explicitly allowed is denied by default. An explicit deny in an identity-based policy, a service control policy, or a resource control policy overrides an allow from any source.

Why the others are wrong

  • A — There is no precedence between group-attached and user-attached policies. IAM combines every policy that applies to the principal and then applies the deny-over-allow rule.
  • B — A single explicit deny anywhere is sufficient. A bucket policy could add its own deny, but the identity-based deny already settles the outcome.
  • D — Policies are not ranked by when they were attached. AWS evaluates every policy that applies to the request, and the enforcement logic looks first for an explicit deny in any of them; if one applies, the final decision is deny.

Last verified: 2026-08-28

Question 27 clf-security-fundamentals-027

Intermediate · Choose one

A company wants its employees to sign in with their existing Microsoft Entra ID credentials and then access several AWS accounts within its AWS Organizations structure. Which service should the company use?

  1. a AWS Resource Access Manager
  2. b AWS Directory Service AD Connector
  3. c Amazon Cognito
  4. d AWS IAM Identity Center
Show answer & explanation

Answer: D

Why D is correct

AWS IAM Identity Center connects workforce users to AWS accounts and AWS managed applications. Deployed as an organization instance in the AWS Organizations management account, it becomes the single point for managing user access across accounts, and it federates with an external identity provider such as Microsoft Entra ID or Okta through SAML 2.0, so the company federates once rather than per account.

Why the others are wrong

  • A — AWS Resource Access Manager shares resources such as subnets and Transit Gateways between accounts. It does not authenticate people.
  • B — AD Connector is a directory proxy that redirects requests to an existing on-premises Microsoft Active Directory. It can serve as an identity source for on-premises AD, but it does not federate a cloud identity provider such as Microsoft Entra ID and it does not manage access across multiple AWS accounts.
  • C — Amazon Cognito is an identity platform for a company's web and mobile application end users, not for its own employees signing in to AWS accounts.

Last verified: 2026-08-28

Question 28 clf-security-fundamentals-028

Intermediate · Choose one

A startup is building a mobile application and needs sign-up, sign-in, and social identity provider support for the consumers who use the app. Which AWS service is designed for this requirement?

  1. a AWS IAM Identity Center
  2. b AWS Directory Service
  3. c Amazon Cognito
  4. d AWS Identity and Access Management (IAM)
Show answer & explanation

Answer: C

Why C is correct

Amazon Cognito is an identity platform for web and mobile apps, acting as a user directory, an authentication server, and an authorization service. A user pool handles sign-up and sign-in for the app's own users, including federation with social providers, while an identity pool can exchange those tokens for temporary AWS credentials when the app must call AWS services directly.

Why the others are wrong

  • A — IAM Identity Center manages workforce access, meaning a company's own employees reaching AWS accounts and AWS managed applications. It is not intended as the sign-in system for a consumer application.
  • B — AWS Directory Service provides Microsoft Active Directory capabilities for enterprise workloads and directory-aware applications, not consumer app sign-in.
  • D — IAM controls access by principals to AWS resources. Creating an IAM user for every consumer of a mobile app does not scale and is not the intended use of the service.

Last verified: 2026-08-28

Question 29 clf-security-fundamentals-029

Intermediate · Choose one

An application connects to an Amazon RDS database, and the security team requires that the database credentials be rotated automatically on a schedule without the team writing and maintaining custom rotation code. Which service meets this requirement?

  1. a AWS Secrets Manager
  2. b AWS Key Management Service
  3. c IAM access keys attached to a dedicated IAM user
  4. d AWS Systems Manager Parameter Store standard parameters
Show answer & explanation

Answer: A

Why A is correct

AWS Secrets Manager stores secrets encrypted with AWS KMS and provides built-in automatic rotation on a configurable schedule. For Amazon RDS, Aurora, DocumentDB, and Redshift it offers managed rotation, so the credential is rotated without the customer supplying a rotation function.

Why the others are wrong

  • B — AWS KMS creates and manages the encryption keys that protect a secret. It does not store the database credential or rotate it.
  • C — IAM access keys authenticate a principal to AWS APIs. They are not the database engine's own username and password, and they carry no automatic rotation.
  • D — Parameter Store securely stores configuration data and secrets as SecureString parameters, but it has no built-in rotation. The AWS documentation itself points to Secrets Manager for database credentials because of that difference.

Last verified: 2026-08-28

Question 30 clf-security-fundamentals-030

Hard · Select 2 answers

Which TWO tasks require the account root user credentials in a standalone AWS account that is not part of an organization? (Choose TWO.)

  1. a Changing the email address associated with the root user
  2. b Enabling AWS CloudTrail in an additional AWS Region
  3. c Closing the AWS account
  4. d Creating an IAM role that an Amazon EC2 instance will assume
  5. e Changing the AWS Support plan for the account
Show answer & explanation

Answer: A and C

Why A and C are correct

AWS publishes a short list of tasks that only the root user can perform. Closing the account is on it, and for a standalone account so is changing the root user email address, root password, or root access keys. The common thread is that these actions concern the account itself rather than resources inside it.

Why the others are wrong

  • B — Enabling CloudTrail or creating a trail in another Region requires CloudTrail permissions, which can be granted to an IAM identity like any other service permission.
  • D — Creating IAM roles is a standard administrative action available to any principal holding the relevant IAM permissions, and it should not be performed as the root user.
  • E — This is a frequently repeated but outdated answer. AWS documentation now states that changing the support plan requires IAM permissions, and the task no longer appears on the list of root-only actions.

Last verified: 2026-08-28