Security Fundamentals — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Security and Compliance ·100 questions · 30 easy · 40 intermediate · 30 hard · page 3 of 7

Question 31 clf-security-fundamentals-031

Hard · Choose one

A company uses AWS Organizations and wants to delete the root user credentials in its member accounts entirely, so that no one can sign in as the root user in those accounts. Which capability supports this?

  1. a Deleting the root user identity from IAM in each member account
  2. b An IAM permissions boundary applied to the root user in each member account
  3. c A service control policy attached to each member account that denies all actions to the root user
  4. d Centralized root access management in AWS Organizations, which lets the management account remove root user credentials from member accounts
Show answer & explanation

Answer: D

Why D is correct

With centralized root access management enabled, the management account or a delegated administrator can remove the root user password, access keys, signing certificates, and MFA from member accounts. Those accounts can then neither sign in as root nor perform root password recovery, and newly created member accounts have no root credentials by default.

Why the others are wrong

  • A — The root user is intrinsic to the account and is not an IAM identity that can be deleted. Removing its credentials is the supported approach.
  • B — Permissions boundaries apply to IAM users and roles. They cannot be attached to the root user, whose access is not constrained by identity-based policy mechanisms.
  • C — A service control policy can restrict what a member account's principals may do, but it does not remove credentials and does not prevent someone from signing in as the root user.

Last verified: 2026-08-28

Question 32 clf-security-fundamentals-032

Hard · Choose one

Which statement about multi-factor authentication in AWS Identity and Access Management is correct?

  1. a Only one MFA device can be registered per identity, so a lost device requires account recovery through AWS Support
  2. b MFA can be enabled for IAM users but not for the account root user
  3. c An identity can register up to eight MFA devices, chosen from passkeys and security keys, virtual authenticator applications, and hardware TOTP tokens
  4. d SMS text message MFA is the option AWS recommends for the account root user
Show answer & explanation

Answer: C

Why C is correct

AWS supports three MFA types: passkeys and FIDO security keys, virtual authenticator applications, and hardware time-based one-time password tokens. The root user and IAM users can each register up to eight devices of any type, and AWS recommends registering multiple devices to add resilience if one is lost.

Why the others are wrong

  • A — The one-device limit was raised. Registering several devices is now explicitly recommended precisely so that losing one does not lock the identity out.
  • B — MFA on the root user is not merely available but required. AWS now requires MFA to be configured for the root user across standalone, management, and member accounts.
  • D — AWS ended support for enabling SMS text message MFA and advises customers still using it to move to a passkey or security key, a virtual MFA device, or a hardware MFA device.

Last verified: 2026-08-28

Question 33 clf-security-fundamentals-033

Hard · Choose one

A company attaches a service control policy to an organizational unit in AWS Organizations. What is the effect of that policy?

  1. a It replaces the identity-based policies that already exist in the affected accounts
  2. b It sets the maximum permissions available to IAM users and roles in the affected member accounts, without granting any permissions itself
  3. c It grants the listed permissions to every IAM user and role in the affected accounts
  4. d It applies to the organization's management account in the same way that it applies to member accounts
Show answer & explanation

Answer: B

Why B is correct

AWS states plainly that no permissions are granted by a service control policy. An SCP defines a permissions guardrail that caps what principals in the affected member accounts can do. A principal still needs an identity-based or resource-based policy granting the action, and the SCP determines whether that grant can take effect.

Why the others are wrong

  • A — SCPs sit alongside identity-based policies during evaluation rather than replacing them. Both must permit an action for it to succeed.
  • C — SCPs never grant. An action allowed by an SCP but not allowed by any IAM policy remains denied.
  • D — AWS states that SCPs do not affect users or roles in the management account. They affect only the member accounts of the organization.

Last verified: 2026-08-28

Question 34 clf-security-fundamentals-034

Easy · Choose one

Which AWS service automatically defends against the most common network and transport layer distributed denial of service attacks for all AWS customers at no additional charge?

  1. a AWS Firewall Manager
  2. b AWS Shield Standard
  3. c AWS WAF
  4. d Amazon GuardDuty
Show answer & explanation

Answer: B

Why B is correct

AWS Shield Standard is built into the AWS services a customer already uses, with no subscription, commitment, or additional charge. It defends against the common and most frequently occurring network and transport layer, meaning layer 3 and layer 4, DDoS events such as SYN floods and reflection attacks.

Why the others are wrong

  • A — AWS Firewall Manager centrally administers firewall policies across accounts. It manages other services' protections rather than mitigating attacks itself.
  • C — AWS WAF inspects HTTP and HTTPS requests at the application layer. It is a chargeable service, is not automatically applied, and does not address layer 3 or layer 4 attacks.
  • D — Amazon GuardDuty detects threats by analyzing account, network, and DNS activity. It raises findings but does not block or absorb attack traffic.

Last verified: 2026-08-28

Question 35 clf-security-fundamentals-035

Easy · Choose one

Which AWS service inspects and filters HTTP and HTTPS requests, blocking patterns such as SQL injection and cross-site scripting before they reach an application?

  1. a AWS WAF
  2. b AWS Shield Standard
  3. c A VPC network ACL
  4. d Amazon Inspector
Show answer & explanation

Answer: A

Why A is correct

AWS WAF is a web application firewall that operates at layer 7. A web ACL of rules evaluates each request and allows it, blocks it with an HTTP 403, or returns a custom response. Managed rule groups maintained by AWS and by AWS Marketplace sellers cover common exploits including SQL injection and cross-site scripting, and are updated as new threats emerge.

Why the others are wrong

  • B — AWS Shield Standard mitigates volumetric network and transport layer attacks. It does not parse the content of an HTTP request.
  • C — A network ACL filters on IP addresses, protocols, and ports at the subnet boundary. It cannot see whether a request body contains an injection attempt.
  • D — Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure. It reports risks rather than filtering live traffic.

Last verified: 2026-08-28

Question 36 clf-security-fundamentals-036

Intermediate · Select 2 answers

A security team must find software vulnerabilities in its Amazon EC2 instances and container images, and separately must discover personally identifiable information stored in Amazon S3. Which TWO services should the team use? (Choose TWO.)

  1. a Amazon Macie
  2. b Amazon GuardDuty
  3. c Amazon Inspector
  4. d AWS Shield Advanced
  5. e AWS Certificate Manager
Show answer & explanation

Answer: A and C

Why A and C are correct

Amazon Inspector is a vulnerability management service that automatically discovers workloads and continually scans them for software vulnerabilities and unintended network exposure, covering EC2 instances, container images in Amazon ECR, and Lambda functions. Amazon Macie is a data security service that uses machine learning and pattern matching to discover sensitive data in Amazon S3.

Why the others are wrong

  • B — Amazon GuardDuty is a threat detection service that identifies malicious or unauthorized activity from activity logs. It does not enumerate software vulnerabilities or classify stored data.
  • D — AWS Shield Advanced provides enhanced DDoS protection for specific resource types. It is unrelated to vulnerability scanning or data discovery.
  • E — AWS Certificate Manager provisions, deploys, and renews TLS certificates. It plays no part in either requirement.

Last verified: 2026-08-28

Question 37 clf-security-fundamentals-037

Intermediate · Choose one

A company with dozens of AWS accounts wants to define AWS WAF rules and VPC security group policies centrally, enforce them across every account, and have them applied automatically to newly created accounts. Which service does this, and what does it require?

  1. a AWS Firewall Manager, which requires the accounts to be managed by AWS Organizations
  2. b AWS WAF, which can be configured once and applied to all accounts without any additional service
  3. c AWS Shield Advanced, which extends its protections to every account in the payer's organization automatically
  4. d Amazon GuardDuty, which distributes firewall rules to member accounts once a delegated administrator is set
Show answer & explanation

Answer: A

Why A is correct

AWS Firewall Manager centrally configures and manages firewall rules across accounts and resources, and automatically applies protections to new accounts and resources as they are added. Its prerequisites include membership in AWS Organizations, a designated Firewall Manager administrator account, and AWS Config enabled. Policy types cover AWS WAF, Shield Advanced, security groups, network ACLs, and DNS Firewall.

Why the others are wrong

  • B — A web ACL in AWS WAF is created and associated within one account. Nothing in AWS WAF alone propagates configuration across an organization or onto future accounts.
  • C — Shield Advanced is billed per organization, but protection is an explicit opt-in for each resource, and it does not distribute WAF or security group policies.
  • D — GuardDuty detects threats and can be administered organization-wide, but it does not create or enforce firewall rules.

Last verified: 2026-08-28

Question 38 clf-security-fundamentals-038

Intermediate · Choose one

A company must manage its encryption keys in single-tenant, dedicated hardware security modules that it alone controls, with AWS having no access to the key material. Which service meets this requirement?

  1. a AWS Key Management Service with a customer managed key
  2. b AWS Key Management Service with an AWS managed key
  3. c AWS CloudHSM
  4. d AWS Secrets Manager
Show answer & explanation

Answer: C

Why C is correct

AWS CloudHSM gives single-tenant access to dedicated hardware security modules that the customer controls, with user management performed inside the HSM rather than through IAM. AWS states that it has no access to the keys or data inside a CloudHSM cluster. Clusters can run in FIPS 140-3 Security Level 3 mode, though that alone is not the deciding factor, because AWS KMS keys are also protected by FIPS 140-3 Security Level 3 validated HSMs. What distinguishes CloudHSM is the tenancy and control model: a dedicated cluster in the customer's own VPC, with key material AWS cannot reach.

Why the others are wrong

  • A — A customer managed key gives full control over its policy, rotation, and deletion, but by default it is created in the AWS-operated KMS key store rather than in dedicated hardware the customer controls, and AWS KMS performs cryptographic operations with it on the customer's behalf.
  • B — An AWS managed key is created by an AWS service on the customer's behalf. The customer can view and audit it but cannot modify it, and the hardware is multi-tenant and operated by AWS.
  • D — AWS Secrets Manager stores and rotates secrets such as credentials. It is not a key management service and does not provide dedicated cryptographic hardware.

Last verified: 2026-08-28

Question 39 clf-security-fundamentals-039

Hard · Choose one

A company subscribes to AWS Shield Advanced and wants around-the-clock engagement with the AWS Shield Response Team during a DDoS event. What is required for the company to obtain that support?

  1. a The account must also have a Business or Enterprise AWS Support plan
  2. b The company must pay an additional per-incident engagement fee at the time of the attack
  3. c AWS WAF Bot Control must be enabled on every protected resource
  4. d AWS Firewall Manager must be enabled and managing the protected resources
Show answer & explanation

Answer: A

Why A is correct

Shield Response Team access is a Shield Advanced benefit, but AWS conditions it on the account being subscribed to the Business Support plan or the Enterprise Support plan. Note that AWS is retiring the Business Support plan on 1 January 2027 and replacing it with Business Support+, so the same requirement will be expressed with the newer plan name. Shield Advanced itself is billed monthly per organization with a one-year commitment, and separately includes DDoS cost protection in the form of service credits for usage spikes caused by an attack.

Why the others are wrong

  • B — There is no per-incident engagement fee. The entitlement follows from the Shield Advanced subscription combined with the qualifying Support plan.
  • C — Bot Control is a paid AWS WAF feature and is specifically excluded from the AWS WAF usage that Shield Advanced covers at no extra cost. It has no bearing on response team access.
  • D — Firewall Manager helps apply Shield Advanced protections consistently across an organization, but it is not a condition of Shield Response Team engagement.

Last verified: 2026-08-28

Question 40 clf-security-fundamentals-040

Hard · Choose one

A cloud practitioner needs to quickly check whether multi-factor authentication is enabled on the account root user and whether any security groups allow unrestricted access to specific ports, without deploying agents or scanners. Which service provides these checks?

  1. a Amazon Inspector
  2. b AWS Trusted Advisor
  3. c Amazon GuardDuty
  4. d AWS Artifact
Show answer & explanation

Answer: B

Why B is correct

AWS Trusted Advisor inspects an account against best-practice checks in categories that include security, and reports findings with recommended actions. MFA on the root account and security groups with specific ports unrestricted are both core security checks, and they are among the small set available to every account regardless of support plan.

Why the others are wrong

  • A — Amazon Inspector scans workloads such as EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure. It does not evaluate account-level settings like root user MFA.
  • C — Amazon GuardDuty analyzes activity logs to detect threats in progress. It would report suspicious root user activity but does not audit whether MFA has been configured.
  • D — AWS Artifact distributes AWS compliance reports and agreements. It performs no inspection of the customer's account configuration.

Last verified: 2026-08-28

Question 41 clf-security-fundamentals-041

Easy · Choose one

A company deploys an application on Amazon EC2 instances. Which task is part of the company's security IN the cloud responsibility?

  1. a Maintaining the physical network links between Availability Zones
  2. b Applying firmware updates to the host servers that run the hypervisor
  3. c Replacing failed disks in the racks that host the instances
  4. d Configuring the IAM policies that determine which employees can start and stop the instances
Show answer & explanation

Answer: D

Why D is correct

AWS divides the model into security OF the cloud, which AWS performs, and security IN the cloud, which the customer performs. Everything the customer can configure through the AWS APIs and console sits on the customer side, and deciding which identities may act on a resource is one of the clearest examples.

Why the others are wrong

  • A — The network fabric connecting Availability Zones is AWS-owned global infrastructure and is entirely AWS's responsibility.
  • B — The hypervisor and the host firmware beneath it are part of the virtualization layer AWS maintains. Customers have no access to that layer.
  • C — Hardware maintenance inside AWS facilities is part of the infrastructure AWS operates. Customers never see or touch the physical devices.

Last verified: 2026-08-28

Question 42 clf-security-fundamentals-042

Easy · Select 2 answers

Which TWO responsibilities belong to AWS under the shared responsibility model? (Choose TWO.)

  1. a Controlling physical access to the facilities that house AWS infrastructure
  2. b Maintaining the software that powers managed services such as Amazon DynamoDB
  3. c Rotating the database passwords the company's application uses
  4. d Selecting whether the company's Amazon S3 objects are protected with SSE-S3 or with SSE-KMS keys the company controls
  5. e Configuring VPC subnets and route tables for the company's application
Show answer & explanation

Answer: A and B

Why A and B are correct

Both sit in the layer AWS calls security OF the cloud: the hardware, software, networking, and facilities that run AWS Cloud services. The customer can neither see nor configure the service software behind a managed service, nor enter an AWS data center, so neither task can be delegated back to them.

Why the others are wrong

  • C — Credentials belonging to the customer's application are customer content. AWS offers services that help manage and rotate them but does not own them.
  • D — Amazon S3 now encrypts every new object with SSE-S3 automatically, but the customer still chooses which encryption method protects its content and, for SSE-KMS, which key and key policy govern it. Those choices, and the data they protect, remain customer responsibilities.
  • E — Network architecture inside a VPC is built entirely by the customer using AWS-provided constructs, and is a core security IN the cloud task.

Last verified: 2026-08-28

Question 43 clf-security-fundamentals-043

Easy · Choose one

A company stores files in Amazon S3. Under the shared responsibility model, which task is the company responsible for?

  1. a Deciding which IAM principals and AWS accounts may read the objects
  2. b Maintaining the storage hardware that physically holds the objects
  3. c Patching the service software that runs Amazon S3
  4. d Ensuring that the service meets its published durability design
Show answer & explanation

Answer: A

Why A is correct

Amazon S3 is an abstracted service: AWS operates the infrastructure, the operating system, and the platform, and the customer interacts only with endpoints. What remains with the customer is the content itself, its classification, its encryption choices, and the permissions that decide who may reach it.

Why the others are wrong

  • B — Storage hardware is AWS infrastructure. Its maintenance, replacement, and eventual secure destruction are AWS responsibilities.
  • C — The software implementing the service is operated by AWS. Customers have no ability to patch it and no visibility into it.
  • D — Durability is an attribute of the service that AWS engineers and operates, achieved by redundancy that AWS manages internally.

Last verified: 2026-08-28

Question 44 clf-security-fundamentals-044

Easy · Choose one

A company runs a containerized workload on AWS Fargate rather than on Amazon EC2 instances it manages. Which responsibility does AWS take on as a result?

  1. a Configuring the security groups that control network access to the tasks
  2. b Choosing the IAM task role permissions that the containers use
  3. c Building and scanning the container images that the tasks run
  4. d Patching and maintaining the operating system of the compute infrastructure that runs the containers
Show answer & explanation

Answer: D

Why D is correct

Fargate is a serverless compute engine, so AWS provisions, patches, and maintains the underlying compute capacity and its operating system. The customer never chooses an instance type or logs into a host, which is exactly the operational surface that moves to AWS.

Why the others are wrong

  • A — Network access controls for a task are configured by the customer. AWS provides the security group construct; the rules inside it are a customer decision.
  • B — Permissions granted to a task are defined by the customer in an IAM role. Fargate changes where the container runs, not who decides what it may do.
  • C — The container image, its base layers, and its dependencies are software the customer supplies. Their security remains the customer's responsibility on any compute platform.

Last verified: 2026-08-28

Question 45 clf-security-fundamentals-045

Intermediate · Choose one

AWS names awareness and training as one of its shared controls. What does that mean in practice?

  1. a AWS trains its own employees, and the customer must train its own employees
  2. b AWS delivers security awareness training to the customer's employees on request
  3. c Neither party needs to provide training, because the AWS compliance certifications cover the requirement
  4. d The customer is responsible for training AWS staff on the customer's compliance requirements
Show answer & explanation

Answer: A

Why A is correct

A shared control is one where both parties carry out the same class of activity in completely separate contexts. For awareness and training, each organization is accountable for its own workforce: AWS trains AWS employees, and the customer trains the people who build and operate the customer's workloads.

Why the others are wrong

  • B — AWS publishes training and certification offerings commercially, but delivering a customer's internal security awareness program is not part of the shared responsibility model.
  • C — Certifications attest that AWS operates its controls effectively. They say nothing about whether the customer's own staff are trained, which auditors will still expect the customer to demonstrate.
  • D — Responsibility never runs in that direction. AWS personnel are governed by AWS internal controls, which the customer evidences through AWS audit reports rather than by training AWS staff.

Last verified: 2026-08-28