Security Fundamentals — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Security and Compliance ·100 questions · 30 easy · 40 intermediate · 30 hard · page 5 of 7

Question 61 clf-security-fundamentals-061

Intermediate · Choose one

A company operates 30 AWS accounts across several AWS Regions and wants one central view of resource configuration and compliance for all of them. Which capability provides this?

  1. a An AWS Config aggregator
  2. b An AWS Artifact organization agreement
  3. c An AWS CloudTrail organization trail
  4. d An Amazon CloudWatch dashboard
Show answer & explanation

Answer: A

Why A is correct

An aggregator collects AWS Config configuration and compliance data from multiple accounts and Regions into a single account, so a governance team can review resource inventory and rule compliance across the estate without signing in to each account.

Why the others are wrong

  • B — AWS Artifact agreements are legal documents accepted on behalf of an organization. They are unrelated to configuration compliance.
  • C — An organization trail centralizes CloudTrail API activity, not configuration state and rule compliance.
  • D — A CloudWatch dashboard visualizes metrics and logs. It has no view of Config rule evaluations across accounts.

Last verified: 2026-08-28

Question 62 clf-security-fundamentals-062

Intermediate · Choose one

What is an AWS Config conformance pack?

  1. a A set of preventive guardrails that block non-compliant API calls before they succeed
  2. b A downloadable AWS audit report that proves an AWS service is compliant with a standard
  3. c A collection of AWS Config rules and remediation actions that is deployed and monitored as a single unit
  4. d A managed group of rules that inspects and filters malicious web requests
Show answer & explanation

Answer: C

Why C is correct

A conformance pack packages Config rules and their remediation actions together so an organization can apply a consistent compliance baseline, for example one aligned to a regulatory framework, to an account or across an organization, and track compliance for the pack as a whole.

Why the others are wrong

  • A — Blocking API calls before they succeed is what a service control policy does. AWS Config is a detective control that evaluates resources after they exist.
  • B — AWS audit reports are obtained from AWS Artifact and attest to AWS's controls, not to the customer's resource configurations.
  • D — Managed rule groups that filter web requests belong to AWS WAF, which inspects HTTP traffic rather than resource configuration.

Last verified: 2026-08-28

Question 63 clf-security-fundamentals-063

Intermediate · Choose one

According to the AWS penetration testing policy, what may a customer do without requesting prior approval from AWS?

  1. a Run their own distributed denial of service simulation against their endpoints, using any tooling and traffic volume they choose
  2. b Perform security testing against permitted resources they own, such as their own Amazon EC2 instances, Amazon RDS databases, and Amazon CloudFront distributions
  3. c Test any AWS service, including the infrastructure that AWS operates for other customers
  4. d Test infrastructure belonging to another AWS customer, provided AWS gives written consent
Show answer & explanation

Answer: B

Why B is correct

AWS permits customers to carry out security assessments against a published list of services for resources they own, without prior approval. The list has expanded over time and includes Amazon EC2, Amazon RDS, Amazon CloudFront, Amazon API Gateway, AWS Lambda, Amazon ECS, AWS Fargate, and others.

Why the others are wrong

  • A — Denial of service and simulated denial of service testing appear on the prohibited activities list in the penetration testing policy. DDoS simulation is governed by a separate AWS policy that requires an AWS pre-approved DDoS test partner and published traffic thresholds, and anything outside that requires a Simulated Events form submitted in advance.
  • C — The policy covers only resources the customer owns. Testing AWS's own infrastructure or other tenants is never permitted.
  • D — Testing another customer's infrastructure is out of scope of the policy entirely, and AWS does not grant consent on another customer's behalf.

Last verified: 2026-08-28

Question 64 clf-security-fundamentals-064

Intermediate · Choose one

A company must encrypt objects in an Amazon S3 bucket with a key that the company creates, can disable centrally at any moment without changing the application, and whose every use is recorded in AWS CloudTrail. Which option meets all three requirements?

  1. a Server-side encryption with Amazon S3 managed keys (SSE-S3)
  2. b Enabling an AWS Config rule that checks whether the bucket is encrypted
  3. c Server-side encryption with AWS KMS keys (SSE-KMS) using a customer managed key
  4. d Server-side encryption with customer-provided keys (SSE-C), where the key is supplied on every request
Show answer & explanation

Answer: C

Why C is correct

A customer managed key is created and owned by the customer, who controls its key policy, can enable or disable it and schedule its deletion, and sees every cryptographic operation against it as a CloudTrail event. Disabling the key immediately stops objects protected by it from being decrypted, without touching the application.

Why the others are wrong

  • A — SSE-S3 uses keys that Amazon S3 owns and manages. The customer cannot disable them, set a policy on them, or audit their individual use.
  • B — A Config rule reports whether encryption is configured. It is a detective check and provides no key control at all.
  • D — With SSE-C the customer holds the key outside AWS and must send it with every request, so there is no central place to disable it and no AWS-side audit trail of key usage.

Last verified: 2026-08-28

Question 65 clf-security-fundamentals-065

Intermediate · Select 2 answers

An auditor asks a company to show both how its AWS resources were configured over the past year and which identity changed them. Which TWO services should the company use? (Choose TWO.)

  1. a AWS Artifact
  2. b Amazon Inspector
  3. c AWS Config
  4. d Amazon CloudWatch
  5. e AWS CloudTrail
Show answer & explanation

Answer: C and E

Why C and E are correct

The two services are complementary halves of an audit trail. AWS Config keeps the configuration history of each resource, answering what the resource looked like and when it changed, while AWS CloudTrail records the API calls, answering which principal made the change, from where, and with what parameters.

Why the others are wrong

  • A — AWS Artifact provides AWS's own audit reports and agreements. It contains no information about the customer's resources.
  • B — Amazon Inspector reports software vulnerabilities and unintended network exposure in workloads, which is a different question from who changed what.
  • D — Amazon CloudWatch collects metrics, logs, and alarms describing how systems are performing. It holds neither configuration history nor a record of API callers.

Last verified: 2026-08-28

Question 66 clf-security-fundamentals-066

Hard · Select 2 answers

Which TWO statements about AWS Key Management Service keys are correct? (Choose TWO.)

  1. a A customer managed key can be enabled, disabled, scheduled for deletion, and governed by a key policy the customer writes
  2. b AWS owned keys appear in the customer's account, where they can be viewed and audited in the console
  3. c AWS KMS keys can be used only to encrypt data stored in Amazon S3
  4. d An AWS managed key is created by an AWS service on the customer's behalf and is rotated automatically every year
  5. e Rotating a KMS key changes its key ID and ARN, so applications must be updated to reference the new key
Show answer & explanation

Answer: A and D

Why A and D are correct

The three key types differ in who creates and controls them. AWS managed keys are created by a service for use on the customer's behalf, are visible in the account, cannot be modified, and are rotated by AWS annually. Customer managed keys give the customer full lifecycle control, including the key policy, enabling and disabling, rotation settings, and scheduled deletion.

Why the others are wrong

  • B — AWS owned keys belong to an AWS service and are used across many accounts. They are not in the customer's account and cannot be viewed, audited, or managed by the customer.
  • C — AWS KMS is integrated with a wide range of services, including Amazon EBS, Amazon RDS, AWS Secrets Manager, and Amazon DynamoDB, and can also be called directly to encrypt small amounts of data.
  • E — Rotation creates new backing key material while the key ID and ARN stay the same, so applications continue to work unchanged and older data is still decryptable with the retained material.

Last verified: 2026-08-28

Question 67 clf-security-fundamentals-067

Hard · Choose one

An organization must ensure that identities outside the organization cannot access its Amazon S3 buckets, regardless of the bucket policies that individual account owners write. Which AWS Organizations policy type is designed for this?

  1. a A service control policy (SCP)
  2. b An IAM permissions boundary
  3. c An AWS Config conformance pack
  4. d A resource control policy (RCP)
Show answer & explanation

Answer: D

Why D is correct

Resource control policies set the maximum permissions available on the resources in an organization's accounts, which lets a central team restrict access by external principals even when a local bucket policy tries to grant it. Like service control policies, they grant nothing on their own and do not apply to the management account's resources.

Why the others are wrong

  • A — A service control policy caps what the principals inside the organization's member accounts may do. It does not constrain an external principal reaching a resource through a resource-based policy.
  • B — A permissions boundary applies to a single IAM user or role in one account, so it cannot express an organization-wide rule about who may reach a resource.
  • C — A conformance pack detects and can remediate non-compliant configurations after the fact. It is not an authorization control evaluated on each request.

Last verified: 2026-08-28

Question 68 clf-security-fundamentals-068

Hard · Choose one

A regulator requires a company to keep a searchable record of AWS API activity for seven years. Which approach meets the requirement?

  1. a Enable AWS Config, which retains a seven-year record of API calls
  2. b Export Amazon CloudWatch metrics to Amazon S3 on a monthly schedule
  3. c Rely on CloudTrail Event history, which retains events indefinitely at no charge
  4. d Create a CloudTrail trail that delivers events to Amazon S3, or use a CloudTrail Lake event data store configured with an extended retention period
Show answer & explanation

Answer: D

Why D is correct

Long-term retention requires the customer to direct events somewhere durable. A trail writes events continuously to an S3 bucket the customer controls and retains for as long as its lifecycle policy says, while a CloudTrail Lake event data store keeps events in a queryable store with retention that can be configured for many years.

Why the others are wrong

  • A — AWS Config records resource configuration state, not API calls, so it cannot serve as the API activity record an auditor is asking for.
  • B — CloudWatch metrics are numeric time series about performance and utilization. They contain no record of who called which API.
  • C — Event history is limited to the last 90 days of management events in each Region. It is free and requires no setup, but it cannot satisfy a multi-year requirement.

Last verified: 2026-08-28

Question 69 clf-security-fundamentals-069

Hard · Choose one

In AWS Control Tower, what characterizes a detective control?

  1. a It uses AWS Config rules to identify resources that are not compliant and reports them, without blocking the action that created them
  2. b It uses AWS CloudFormation hooks to stop non-compliant resources from being provisioned
  3. c It uses a service control policy to block a non-compliant API call before it can succeed
  4. d It automatically reverses any non-compliant change as soon as the change is detected
Show answer & explanation

Answer: A

Why A is correct

AWS Control Tower groups controls, formerly called guardrails, by behavior. A detective control inspects resources that already exist, is implemented with AWS Config rules, and surfaces a clear or in-violation status on the dashboard so an owner can act.

Why the others are wrong

  • B — Evaluating resources before they are provisioned and refusing non-compliant ones describes a proactive control, implemented with CloudFormation hooks.
  • C — Blocking the call before it succeeds describes a preventive control, implemented with policies such as service control policies.
  • D — Detection and remediation are separate. A detective control reports the violation; automatic correction requires a remediation action the customer configures.

Last verified: 2026-08-28

Question 70 clf-security-fundamentals-070

Hard · Choose one

Which statement about default encryption at rest in AWS is correct?

  1. a Amazon EBS encrypts every volume automatically, while Amazon S3 requires default encryption to be switched on for each bucket
  2. b Amazon S3 automatically encrypts all new object uploads at no additional cost, while Amazon EBS encryption is applied per volume or through a per-Region default setting the customer enables
  3. c Both Amazon S3 and Amazon EBS encrypt all new data automatically with no customer action required
  4. d Neither Amazon S3 nor Amazon EBS encrypts data unless the customer supplies a customer managed AWS KMS key
Show answer & explanation

Answer: B

Why B is correct

The two services behave differently and are often confused. Amazon S3 applies server-side encryption with S3 managed keys to every new object upload as a baseline that cannot be turned off, at no extra cost. Amazon EBS encryption is a choice made when a volume is created, and an account can set encryption by default as a per-Region setting so new volumes are always encrypted.

Why the others are wrong

  • A — This reverses the two behaviors. Bucket-level default encryption is no longer a prerequisite for new S3 objects to be encrypted.
  • C — This is true of Amazon S3 but not of Amazon EBS, where encryption by default must be enabled by the customer in each Region.
  • D — Neither service requires a customer managed key. Amazon S3 uses S3 managed keys by default, and Amazon EBS can use the AWS managed key for EBS.

Last verified: 2026-08-28

Question 71 clf-security-fundamentals-071

Easy · Choose one

What is an IAM policy?

  1. a A credential used to sign programmatic requests made to AWS
  2. b A container used to group IAM users so that their usage can be billed separately
  3. c A record of the API calls that an identity has made in the account
  4. d A JSON document that defines permissions and can be attached to an identity or to a resource
Show answer & explanation

Answer: D

Why D is correct

A policy is a JSON document containing statements that specify an effect, actions, resources, and optional conditions. Attaching it to a user, group, or role makes it an identity-based policy; attaching it to a resource such as an Amazon S3 bucket makes it a resource-based policy.

Why the others are wrong

  • A — Credentials such as passwords and access keys prove who is making a request. A policy decides what that requester is allowed to do once identified.
  • B — IAM groups collect users for permission management, not for billing. Cost separation is achieved with accounts, tags, and AWS Organizations.
  • C — The record of API calls is produced by AWS CloudTrail, which is a separate service from IAM.

Last verified: 2026-08-28

Question 72 clf-security-fundamentals-072

Easy · Choose one

Which statement about AWS Identity and Access Management (IAM) is correct?

  1. a IAM is charged per IAM user per month, in addition to the resources those users create
  2. b IAM must be enabled separately in each AWS Region that a company uses
  3. c IAM is a global service, so users, groups, roles, and policies are not created per AWS Region
  4. d IAM is designed to manage the sign-in of a company's customers to its public mobile application
Show answer & explanation

Answer: C

Why C is correct

IAM identities and policies are account-wide and are not tied to a Region. A role or user created once can be used against service endpoints in any Region the account has access to, which is why the IAM console does not present a Region selector.

Why the others are wrong

  • A — IAM itself is offered at no additional charge. Customers pay for the AWS resources their identities use.
  • B — There is nothing to enable. IAM exists as soon as the account does, and the root user is present from account creation.
  • D — Consumer sign-in for a company's own application is what Amazon Cognito provides. IAM governs access to AWS resources.

Last verified: 2026-08-28

Question 73 clf-security-fundamentals-073

Easy · Choose one

What does an IAM password policy control?

  1. a Requirements such as minimum length, character types, reuse, and expiration for IAM user console passwords
  2. b Whether multi-factor authentication is required at console sign-in
  3. c How application secrets are stored and automatically rotated
  4. d How often the access keys used for programmatic access are rotated
Show answer & explanation

Answer: A

Why A is correct

A password policy sets account-wide rules for the console passwords of IAM users in that account, covering length, required character types, whether users may change their own password, whether passwords expire, and whether previous passwords may be reused.

Why the others are wrong

  • B — MFA is configured per identity and can be required through a policy condition. It is not part of the password policy.
  • C — Storing and rotating application secrets is the role of AWS Secrets Manager, not of the IAM password policy.
  • D — Access keys are long-term programmatic credentials with no automatic expiry. Rotating them is an operational task guided by last-used information.

Last verified: 2026-08-28

Question 74 clf-security-fundamentals-074

Easy · Choose one

An application running on an Amazon EC2 instance must call Amazon S3. What is the recommended way to give it access without placing long-term credentials on the instance?

  1. a Attach an IAM role to the instance, so the application receives temporary credentials automatically
  2. b Create an Amazon Cognito identity pool and configure the instance as a user of that pool
  3. c Create an IAM user and write its access keys to a configuration file on the instance
  4. d Use the account root user's access keys, stored in an environment variable on the instance
Show answer & explanation

Answer: A

Why A is correct

An instance profile delivers temporary security credentials for the attached role to the instance, and the AWS SDKs retrieve and refresh them automatically. Nothing durable is stored on disk, so there is no key to leak in an image, a backup, or a source repository, and no rotation task.

Why the others are wrong

  • B — Cognito identity pools issue temporary AWS credentials to the end users of a web or mobile application, not to server-side workloads running on EC2.
  • C — Long-term access keys on an instance are exactly the pattern roles exist to eliminate. They persist in snapshots and images and must be rotated manually.
  • D — Root access keys give unrestricted access to the entire account and AWS advises against creating them at all, let alone deploying them to a server.

Last verified: 2026-08-28

Question 75 clf-security-fundamentals-075

Easy · Select 2 answers

Which TWO practices does AWS recommend for securing access to an AWS account? (Choose TWO.)

  1. a Store access keys in the application source code so they are versioned alongside the application
  2. b Use the account root user for daily administration so that all privileged activity is attributable
  3. c Create a single IAM user that the whole team shares, so that permissions stay consistent
  4. d Use temporary credentials rather than long-term access keys wherever possible
  5. e Require multi-factor authentication for human users
Show answer & explanation

Answer: D and E

Why D and E are correct

Both practices attack the same weakness, which is a credential that can be stolen and reused. MFA means a captured password alone is not enough to sign in, and temporary credentials, obtained by assuming a role or through federation, expire on their own so a leaked credential has a short life.

Why the others are wrong

  • A — Credentials in source code are among the most common causes of exposure, since they spread through repositories, forks, and build artifacts.
  • B — AWS advises against using the root user for routine work. Daily administration should be performed with IAM roles or IAM Identity Center users that carry only the permissions needed.
  • C — A shared identity destroys accountability, since the logs cannot show which person acted, and it makes removing one person's access impossible without disrupting everyone.

Last verified: 2026-08-28