Security Fundamentals — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Security and Compliance ·100 questions · 30 easy · 40 intermediate · 30 hard · page 4 of 7

Question 46 clf-security-fundamentals-046

Intermediate · Choose one

A company stores application records in Amazon DynamoDB. Which task remains the company's responsibility?

  1. a Patching the operating system of the servers that run the DynamoDB service
  2. b Replicating table data across Availability Zones so the service meets its availability design
  3. c Classifying the data and configuring the IAM permissions that control access to the tables
  4. d Applying security updates to the DynamoDB service software
Show answer & explanation

Answer: C

Why C is correct

DynamoDB is an abstracted service, so AWS runs everything from the hardware up to the platform. The customer's remaining duties concentrate on the content: knowing what the data is, deciding how sensitive it is, and controlling which principals can read or write it.

Why the others are wrong

  • A — There is no operating system exposed to the customer in DynamoDB. AWS operates the entire fleet behind the service endpoint.
  • B — Redundancy across Availability Zones is built into the service by AWS. The customer does not configure or maintain it.
  • D — The service software is AWS's to maintain. Customers cannot install or defer updates to it.

Last verified: 2026-08-28

Question 47 clf-security-fundamentals-047

Intermediate · Choose one

AWS describes some controls as customer specific, meaning they are solely the customer's responsibility based on the application being deployed. Which of the following is the example AWS gives?

  1. a Patch management, performed by AWS on infrastructure and by the customer on guest operating systems
  2. b Physical and environmental controls at the data centers hosting the workload
  3. c Awareness and training, delivered by AWS to AWS employees and by the customer to its own employees
  4. d Zone security, where the customer routes or segments data within specific security environments for its own application
Show answer & explanation

Answer: D

Why D is correct

Customer specific controls have no AWS counterpart at all. AWS names service and communications protection, and zone security, as controls that depend entirely on how the customer designs and segments its own application, so AWS performs no equivalent activity.

Why the others are wrong

  • A — Patch management is one of the three shared controls, carried out by both parties in different scopes.
  • B — Physical and environmental controls are inherited controls. The customer fully inherits them from AWS and performs no part of them.
  • C — Awareness and training is also a shared control, since both AWS and the customer must train their own people.

Last verified: 2026-08-28

Question 48 clf-security-fundamentals-048

Intermediate · Choose one

An auditor asks which party is accountable for classifying the data a company stores in AWS and deciding how long to retain it. Which answer is correct?

  1. a AWS, but only for content stored in abstracted services such as Amazon S3
  2. b Both parties equally, because data protection is defined as a shared control
  3. c The customer, because AWS states that customers own and control their content
  4. d AWS, because AWS operates the storage services that hold the content
Show answer & explanation

Answer: C

Why C is correct

Ownership of content never transfers to AWS. The customer chooses which services hold the data, which AWS Regions store it, how it is classified and encrypted, and who may access it. Retention and classification are decisions only the data owner can make.

Why the others are wrong

  • A — Moving to an abstracted service reduces the customer's operational work but does not transfer ownership of the data or the decisions about it.
  • B — The shared controls AWS names are patch management, configuration management, and awareness and training. Data classification is not among them.
  • D — Operating the storage platform is not the same as owning what is stored on it. AWS provides the service; the content and the decisions about it stay with the customer.

Last verified: 2026-08-28

Question 49 clf-security-fundamentals-049

Intermediate · Choose one

Which statement about the AWS shared responsibility model is correct?

  1. a AWS assumes responsibility for the customer's data once that data is stored in an AWS managed service
  2. b The model assigns the customer an identical set of responsibilities regardless of which service is used
  3. c The customer's share of responsibility varies depending on which AWS services the customer selects
  4. d The customer is responsible for the physical security of the Availability Zones in which its workloads run
Show answer & explanation

Answer: C

Why C is correct

AWS states directly that customer responsibility is determined by the AWS Cloud services the customer selects. A workload on Amazon EC2 leaves the customer managing a guest operating system, while the same workload built on an abstracted service leaves the customer managing little beyond data and access.

Why the others are wrong

  • A — Customers retain ownership and control of their content in every AWS service. AWS operates the service, not the data inside it.
  • B — A fixed split would contradict the whole design of the model, which is explicitly service dependent.
  • D — Physical and environmental security is an inherited control that the customer receives wholly from AWS.

Last verified: 2026-08-28

Question 50 clf-security-fundamentals-050

Hard · Choose one

A team configures an AWS Lambda function to use the Manual runtime update mode so that the function stays on one specific runtime version. What is the security consequence of this choice?

  1. a AWS stops publishing security updates for that runtime for all customers
  2. b The function no longer receives new runtime versions automatically, so the team must decide when to move it to a patched runtime
  3. c The function is excluded from the shared responsibility model until the mode is changed back
  4. d The team becomes responsible for patching the operating system of the Lambda execution environment
Show answer & explanation

Answer: B

Why B is correct

AWS curates and publishes security updates for supported managed runtimes, and by default applies them automatically. Choosing Manual mode pins the function to one runtime version, which is useful for rolling back an incompatible change, but it moves the timing decision, and therefore the exposure window, to the customer.

Why the others are wrong

  • A — AWS continues to publish runtime updates regardless of any one customer's update mode. Manual mode only changes whether that function picks them up.
  • C — Every workload on AWS sits inside the model. The boundary can shift with the service and its configuration, but nothing falls outside it.
  • D — The execution environment's operating system is AWS's responsibility in every Lambda update mode. The customer has no host to patch.

Last verified: 2026-08-28

Question 51 clf-security-fundamentals-051

Hard · Choose one

A company uses AWS Systems Manager Patch Manager to automate operating system patching across its Amazon EC2 fleet. How does using this AWS service affect responsibility for guest operating system patching?

  1. a Responsibility transfers to AWS once Patch Manager is enabled on the instances
  2. b Responsibility transfers to AWS, but only for instances launched from AWS-published Amazon Machine Images
  3. c It does not change it; AWS provides the tooling, but deciding on and applying guest operating system patches remains the customer's responsibility
  4. d Responsibility remains with the customer unless the instances are part of an Auto Scaling group
Show answer & explanation

Answer: C

Why C is correct

Using an AWS service to perform a task does not move that task across the responsibility boundary. Patch Manager automates a job the customer owns: the customer still defines the patch baseline, the maintenance window, and the approval rules, and bears the consequence if a patch is never applied.

Why the others are wrong

  • A — No AWS management tool transfers accountability. The distinction is between who operates the layer and who merely automates work within it.
  • B — The origin of the Amazon Machine Image does not change the boundary. Once an instance is running, its guest operating system belongs to the customer.
  • D — Auto Scaling changes how instances are replaced, not who is responsible for the software inside them.

Last verified: 2026-08-28

Question 52 clf-security-fundamentals-052

Hard · Select 2 answers

A company moves from running Kubernetes itself on Amazon EC2 instances to Amazon EKS with AWS Fargate. Which TWO responsibilities move to AWS as a result? (Choose TWO.)

  1. a Patching the operating system of the compute capacity on which the pods run
  2. b Defining the IAM permissions that pods use when calling AWS services
  3. c Building and scanning the container images that the pods run
  4. d Managing, scaling, and patching the Kubernetes control plane
  5. e Configuring the Kubernetes role-based access control rules inside the cluster
Show answer & explanation

Answer: A and D

Why A and D are correct

Each step up the abstraction ladder hands AWS more of the undifferentiated operational work. Amazon EKS runs and patches the control plane, and Fargate removes the worker nodes the customer would otherwise have to patch and size. Both were previously the customer's to operate on self-managed Kubernetes.

Why the others are wrong

  • B — Authorization for the customer's workloads is always a customer decision. Managed compute changes where the pod runs, not what it is permitted to do.
  • C — Container images are software the customer supplies, so their content and vulnerabilities stay with the customer on every platform.
  • E — Kubernetes RBAC is configuration inside the cluster the customer defines. Amazon EKS operates the control plane but does not decide who may do what within it.

Last verified: 2026-08-28

Question 53 clf-security-fundamentals-053

Hard · Choose one

A company claims that because AWS is certified under ISO 27001 and is a PCI DSS Level 1 service provider, the payment application it runs on AWS is automatically PCI DSS compliant. Why is this reasoning wrong?

  1. a AWS certifications cover the infrastructure and services AWS operates, so the customer must still assess and evidence the controls it owns for its own workload
  2. b Compliance can be inherited only if the customer subscribes to a paid AWS Support plan
  3. c Certification is inherited automatically, but only after the customer accepts an agreement in AWS Artifact
  4. d AWS compliance certifications apply only to AWS Regions in the United States
Show answer & explanation

Answer: A

Why A is correct

Compliance follows the same boundary as security. AWS's attestations let a customer inherit and evidence the infrastructure controls rather than testing them, which shortens an audit considerably, but the controls the customer owns, such as access management, encryption choices, logging, and application security, must still be implemented and evidenced by the customer.

Why the others are wrong

  • B — Support plans affect the technical assistance a customer receives. They have no bearing on which compliance obligations the customer carries.
  • C — AWS Artifact is where a customer downloads AWS audit reports and accepts agreements such as a Business Associate Addendum. Accepting an agreement does not certify the customer's own application.
  • D — AWS compliance programs cover services across Regions worldwide, with the scope for each program published by AWS. Geography is not the flaw in the reasoning.

Last verified: 2026-08-28

Question 54 clf-security-fundamentals-054

Easy · Choose one

Which AWS service collects, stores, and lets a team search the application and operating system log files produced by Amazon EC2 instances?

  1. a AWS CloudTrail
  2. b AWS Artifact
  3. c AWS Config
  4. d Amazon CloudWatch Logs
Show answer & explanation

Answer: D

Why D is correct

Amazon CloudWatch Logs centralizes logs from instances, containers, Lambda functions, and AWS services into log groups and log streams, where they can be searched with CloudWatch Logs Insights, filtered into metrics, and used to trigger alarms. It is the destination for logs the customer's own software writes.

Why the others are wrong

  • A — AWS CloudTrail records AWS API activity, meaning which principal called which AWS service. It does not collect the logs an application writes inside an instance.
  • B — AWS Artifact is a portal for AWS compliance reports and agreements and holds no customer telemetry at all.
  • C — AWS Config records the configuration state of AWS resources and evaluates it against rules. It is not a log aggregation service.

Last verified: 2026-08-28

Question 55 clf-security-fundamentals-055

Easy · Choose one

What does encryption in transit protect?

  1. a Encryption keys while they are held inside AWS Key Management Service
  2. b Data after it has been written to storage in an AWS Region
  3. c Archived backup copies of data held in Amazon S3 Glacier storage classes
  4. d Data while it moves across a network between a client and a service
Show answer & explanation

Answer: D

Why D is correct

Encryption in transit protects data on the wire, so that anyone able to observe the network sees only ciphertext. On AWS this is implemented with TLS, which every AWS service endpoint supports and which the customer also applies between their own tiers.

Why the others are wrong

  • A — Key material inside AWS KMS is protected by the hardware security modules AWS operates. That protection is part of the service, not what the term in transit describes.
  • B — Protecting stored data is encryption at rest, a separate control implemented with features such as Amazon EBS volume encryption or Amazon S3 server-side encryption.
  • C — Archived objects are stored data, so they are covered by encryption at rest. They are in transit only while being uploaded or retrieved.

Last verified: 2026-08-28

Question 56 clf-security-fundamentals-056

Easy · Choose one

Which AWS service allows a customer to create, control, rotate, and audit the encryption keys used to protect data across many AWS services?

  1. a AWS Key Management Service (AWS KMS)
  2. b AWS Artifact
  3. c AWS Certificate Manager
  4. d AWS Secrets Manager
Show answer & explanation

Answer: A

Why A is correct

AWS KMS is the managed key service integrated with most AWS services that encrypt data at rest. Keys are created and used inside hardware security modules AWS operates, access is governed by a key policy plus IAM, and every use of a key can be recorded in AWS CloudTrail.

Why the others are wrong

  • B — AWS Artifact distributes AWS compliance documentation and has no cryptographic function.
  • C — AWS Certificate Manager provisions and renews the TLS certificates that protect data in transit. It manages certificates, not the keys that encrypt stored data.
  • D — AWS Secrets Manager stores and rotates secrets such as database credentials. It uses KMS keys to protect those secrets rather than being the key service itself.

Last verified: 2026-08-28

Question 57 clf-security-fundamentals-057

Easy · Choose one

What information do VPC Flow Logs capture?

  1. a The software vulnerabilities present on Amazon EC2 instances in the VPC
  2. b The configuration state of VPC resources and how it has changed over time
  3. c Metadata about the IP traffic going to and from network interfaces in a VPC
  4. d The AWS API calls made by principals in the account
Show answer & explanation

Answer: C

Why C is correct

A flow log records details about accepted and rejected traffic at the network interface, subnet, or VPC level, including source and destination addresses and ports, protocol, packet and byte counts, and the action taken. It is collected outside the traffic path, so it does not affect throughput or latency, and can be delivered to CloudWatch Logs, Amazon S3, or Amazon Data Firehose.

Why the others are wrong

  • A — Vulnerability discovery is the role of Amazon Inspector. Flow logs report connections, not the software running on an instance.
  • B — Configuration state over time is what AWS Config records. Flow logs say nothing about how a resource is configured.
  • D — API activity is recorded by AWS CloudTrail. Flow logs describe packets on the network rather than calls to AWS services.

Last verified: 2026-08-28

Question 58 clf-security-fundamentals-058

Easy · Choose one

Which of the following is a security and compliance benefit of running workloads on AWS?

  1. a Encryption becomes unnecessary because traffic inside the AWS network is private
  2. b Customers no longer need to manage who can access their own data
  3. c Customers build on infrastructure that has already been assessed against standards such as ISO 27001, SOC 2, and PCI DSS
  4. d AWS assumes legal accountability for the customer's regulatory obligations
Show answer & explanation

Answer: C

Why C is correct

AWS maintains a large portfolio of certifications and attestations covering the infrastructure and services it operates. Customers inherit those controls and can evidence them to auditors using the reports in AWS Artifact instead of building and assessing an equivalent control set themselves.

Why the others are wrong

  • A — AWS recommends encrypting data in transit and at rest as a defense-in-depth measure, and many regulations require it regardless of network ownership.
  • B — Access control over customer content is a core customer responsibility in every AWS service, and one of the most common causes of real incidents.
  • D — Legal and regulatory accountability stays with the organization that collects and processes the data. AWS provides evidence about its own controls.

Last verified: 2026-08-28

Question 59 clf-security-fundamentals-059

Intermediate · Choose one

A security team must be able to see a record of every individual object that is read from or written to one specific Amazon S3 bucket. What must the team configure in AWS CloudTrail?

  1. a Nothing, because object-level activity already appears in CloudTrail Event history
  2. b Data events for that bucket, which are not logged by default and incur additional charges
  3. c CloudTrail Insights, which records object-level read and write activity
  4. d An organization trail, which turns on object-level logging for every bucket in the organization
Show answer & explanation

Answer: B

Why B is correct

CloudTrail separates management events, which describe operations on resources themselves and are recorded by default, from data events, which describe operations performed on data within a resource. Amazon S3 object-level activity is a data event, so it must be explicitly selected on a trail or event data store and is billed separately because of its volume.

Why the others are wrong

  • A — Event history shows the last 90 days of management events. Data events never appear there.
  • C — CloudTrail Insights analyzes recorded activity to detect unusual call rates or error rates. It surfaces anomalies rather than capturing a new class of events.
  • D — An organization trail applies a trail's configuration across the accounts in an organization, but it still logs only the event types that trail has been configured to record.

Last verified: 2026-08-28

Question 60 clf-security-fundamentals-060

Intermediate · Choose one

Which statement correctly distinguishes AWS Config from AWS CloudTrail?

  1. a AWS Config records API calls, while AWS CloudTrail records resource configurations
  2. b AWS Config monitors application performance, while AWS CloudTrail monitors resource configuration
  3. c The two services record identical data, but AWS Config retains it for longer
  4. d AWS Config records what a resource's configuration is and how it changed; AWS CloudTrail records who made the request and when
Show answer & explanation

Answer: D

Why D is correct

The two answer different questions and are usually enabled together. Config produces configuration items describing a resource's state and relationships at a point in time and can evaluate that state against rules, while CloudTrail produces events naming the identity, time, source IP address, and parameters of each API call.

Why the others are wrong

  • A — This reverses the two services. Recording API calls is the defining function of CloudTrail.
  • B — Neither service monitors performance. That is the role of Amazon CloudWatch.
  • C — Their data is fundamentally different in kind: configuration state versus request activity. Retention is not the distinction.

Last verified: 2026-08-28