Security Fundamentals — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Security and Compliance ·100 questions · 30 easy · 40 intermediate · 30 hard · page 6 of 7

Question 76 clf-security-fundamentals-076

Intermediate · Choose one

A team in AWS account B needs to read objects from an Amazon S3 bucket in AWS account A. What is the recommended way to grant this access?

  1. a Copy the objects into a bucket in account B on a nightly schedule
  2. b Create an IAM role in account A that trusts account B and grants the required Amazon S3 permissions, and have the account B principals assume it
  3. c Make the bucket publicly readable and rely on the bucket name being difficult to guess
  4. d Create IAM users in account A and share their access keys with the team in account B
Show answer & explanation

Answer: B

Why B is correct

A cross-account role is the standard pattern. The role's trust policy names account B as the principal that may assume it, and its permissions policy defines exactly what may be done in account A. The team receives temporary credentials, and access can be revoked at any time by changing the role.

Why the others are wrong

  • A — Copying data duplicates it, adds cost and latency, and multiplies the number of places the data must be secured and governed.
  • C — Obscurity is not access control. Public buckets are routinely discovered and are one of the most common causes of data exposure.
  • D — Sharing long-term keys across an organizational boundary removes accountability and creates a credential that neither account can easily rotate or revoke cleanly.

Last verified: 2026-08-28

Question 77 clf-security-fundamentals-077

Intermediate · Choose one

What is an IAM permissions boundary?

  1. a A guardrail applied to every account in an AWS organization at once
  2. b A managed policy that sets the maximum permissions an identity-based policy can grant to an IAM user or role
  3. c A limit on how many policies can be attached to a single IAM role
  4. d A policy that grants a set of permissions to an IAM user or role
Show answer & explanation

Answer: B

Why B is correct

A permissions boundary caps rather than grants. The identity's effective permissions are the intersection of its identity-based policies and its boundary, which lets an administrator safely delegate policy creation to a team while guaranteeing they cannot escalate beyond the cap.

Why the others are wrong

  • A — Organization-wide guardrails are service control policies and resource control policies in AWS Organizations. A boundary is attached to one user or role.
  • C — The number of attachable policies is an IAM quota, unrelated to what a permissions boundary does.
  • D — A boundary never grants anything on its own. An action must still be allowed by an identity-based or resource-based policy.

Last verified: 2026-08-28

Question 78 clf-security-fundamentals-078

Intermediate · Choose one

A security team wants a single output listing every IAM user in an account, whether each has MFA enabled, and when each access key was last rotated and used. Which capability provides this?

  1. a An AWS Config aggregator
  2. b Amazon Inspector
  3. c The IAM credential report
  4. d AWS CloudTrail Insights
Show answer & explanation

Answer: C

Why C is correct

The credential report is a downloadable CSV covering all IAM users in the account and the state of their credentials, including password status and last use, MFA status, and the rotation and last-used details of each access key. It can be generated at most once every four hours.

Why the others are wrong

  • A — An aggregator centralizes AWS Config resource configuration and compliance data. It is not a credential inventory.
  • B — Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure, which is unrelated to IAM credentials.
  • D — CloudTrail Insights detects unusual patterns in API call volume or error rates. It reports anomalies, not credential status.

Last verified: 2026-08-28

Question 79 clf-security-fundamentals-079

Intermediate · Choose one

A development team needs to store non-sensitive configuration values, such as service endpoint URLs and feature flags, and retrieve them from applications at no per-item charge. Which service is the appropriate choice?

  1. a AWS Key Management Service
  2. b AWS Systems Manager Parameter Store, using standard parameters
  3. c AWS Secrets Manager
  4. d AWS Artifact
Show answer & explanation

Answer: B

Why B is correct

Parameter Store provides hierarchical storage for configuration data and secrets, with standard parameters available at no additional charge. It suits values that change rarely and do not require automatic rotation, and it can still encrypt sensitive values as SecureString parameters using AWS KMS.

Why the others are wrong

  • A — AWS KMS manages encryption keys. It is not a store for application configuration values.
  • C — Secrets Manager is priced per secret per month plus API calls. Its value is automatic rotation, which plain configuration data does not need.
  • D — AWS Artifact is a repository for AWS compliance reports and agreements and has no application configuration role.

Last verified: 2026-08-28

Question 80 clf-security-fundamentals-080

Intermediate · Choose one

A company uses AWS IAM Identity Center and needs to give one group of engineers the same set of permissions in five different AWS accounts. What should the company create?

  1. a A service control policy attached to the organizational unit containing the five accounts
  2. b An Amazon Cognito user pool containing the engineers
  3. c An IAM user in each of the five accounts, each added to a local IAM group
  4. d A permission set, assigned to that group in each of the five accounts
Show answer & explanation

Answer: D

Why D is correct

A permission set is a reusable definition of permissions that IAM Identity Center applies by creating and maintaining an IAM role in each account where the set is assigned. One definition therefore produces consistent access across many accounts, and changing it updates every account at once.

Why the others are wrong

  • A — A service control policy limits the maximum permissions available in accounts. It grants nothing and cannot give the engineers access.
  • B — Cognito user pools authenticate the end users of a customer-facing application, not a company's own workforce signing in to AWS accounts.
  • C — Creating separate IAM users per account reintroduces exactly the duplication and drift that IAM Identity Center exists to remove, and gives each engineer several sets of credentials.

Last verified: 2026-08-28

Question 81 clf-security-fundamentals-081

Intermediate · Choose one

A company keeps its employee identities in an existing on-premises Microsoft Active Directory and wants AWS to authenticate against that directory without replicating or caching the directory data in the cloud. Which option meets this requirement?

  1. a AWS Managed Microsoft AD with a newly created directory
  2. b An Amazon Cognito user pool synchronized from Active Directory
  3. c AWS Resource Access Manager
  4. d AWS Directory Service AD Connector
Show answer & explanation

Answer: D

Why D is correct

AD Connector is a directory proxy. It forwards authentication requests to the existing on-premises Active Directory rather than storing or replicating directory data in AWS, which is what makes it the right fit when the requirement is explicitly that no directory data may live in the cloud.

Why the others are wrong

  • A — AWS Managed Microsoft AD creates an actual directory running in AWS. It can trust an on-premises domain, but it does hold directory data in the cloud.
  • B — Amazon Cognito is an identity platform for a company's application end users and is not a mechanism for proxying enterprise directory authentication.
  • C — AWS Resource Access Manager shares resources such as subnets between accounts. It does not authenticate people.

Last verified: 2026-08-28

Question 82 clf-security-fundamentals-082

Intermediate · Choose one

What does the trust policy of an IAM role define?

  1. a A record of which principals have assumed the role and when
  2. b Which AWS actions the role is permitted to perform once assumed
  3. c The maximum permissions that can ever be granted to the role
  4. d Which principals are allowed to assume the role
Show answer & explanation

Answer: D

Why D is correct

Every role has two policies working together. The trust policy is a resource-based policy naming the principals that may assume the role, such as an AWS service, another account, or a federated identity provider, while the permissions policy determines what the resulting session may do.

Why the others are wrong

  • A — Role assumption events are recorded by AWS CloudTrail as AssumeRole calls, not stored in the trust policy.
  • B — That is the role's permissions policy. Separating who may assume from what they may do is the reason a role has both.
  • C — A cap on permissions is a permissions boundary, which is attached in addition to the role's other policies.

Last verified: 2026-08-28

Question 83 clf-security-fundamentals-083

Hard · Choose one

An IAM user has an identity-based policy that allows all Amazon EC2 actions. A service control policy attached to the organizational unit containing the account denies ec2:RunInstances. What happens when the user tries to launch an instance?

  1. a The request succeeds, because identity-based policies are evaluated after service control policies and take precedence
  2. b The request is denied only if the account is the organization's management account
  3. c The request is denied, because effective permissions are the intersection of the service control policy and the identity-based policy, and an explicit deny cannot be overridden
  4. d The request succeeds, because service control policies apply only to IAM roles and not to IAM users
Show answer & explanation

Answer: C

Why C is correct

A service control policy is a guardrail, so an action must be permitted by both the SCP and the identity-based policy for the request to succeed. An explicit deny found in any applicable policy ends evaluation immediately, which is why the broad EC2 allow cannot rescue the call.

Why the others are wrong

  • A — There is no ordering by which an identity-based allow can overcome an SCP deny. The evaluation logic looks for an explicit deny across all policy types first.
  • B — The management account is the exception in the opposite direction: SCPs do not restrict principals in the management account, but they do restrict member accounts, which is the case described here.
  • D — SCPs apply to the IAM users and roles in affected member accounts alike.

Last verified: 2026-08-28

Question 84 clf-security-fundamentals-084

Hard · Choose one

A security team must identify which Amazon S3 buckets, IAM roles, and AWS KMS keys in an account can be accessed by principals outside the company's AWS organization. Which capability reports this?

  1. a AWS CloudTrail Insights events
  2. b IAM Access Analyzer external access findings
  3. c The IAM credential report
  4. d Amazon Macie automated sensitive data discovery
Show answer & explanation

Answer: B

Why B is correct

IAM Access Analyzer evaluates the resource-based policies in an account against a defined zone of trust, which can be the account or the whole organization, and reports each resource that can be reached from outside it. The analysis is based on logical reasoning about the policies rather than on observed traffic, so it finds exposure that nobody has exploited yet.

Why the others are wrong

  • A — CloudTrail Insights highlights unusual API call volumes and error rates. It reports on activity, not on the permissions a policy grants.
  • C — The credential report describes the state of IAM user credentials. It says nothing about which resources are shared externally.
  • D — Amazon Macie discovers sensitive data inside Amazon S3 objects. It reports what the data is, not who outside the organization can reach it.

Last verified: 2026-08-28

Question 85 clf-security-fundamentals-085

Hard · Choose one

Which statement about an IAM user group is correct?

  1. a A group can be assumed in order to obtain temporary security credentials
  2. b A group can be nested inside another group so that permissions form a hierarchy
  3. c A group is a collection of IAM users that policies can be attached to; it cannot be named as a principal in a policy and cannot contain other groups
  4. d A group is an identity that can be signed in to directly using its own credentials
Show answer & explanation

Answer: C

Why C is correct

A group is a convenience for managing permissions, not an identity. Because it has no credentials and cannot be a principal, a resource-based policy cannot grant access to a group; it grants to the users or roles themselves. Groups also contain only users, never other groups.

Why the others are wrong

  • A — Assuming an identity to receive temporary credentials describes an IAM role, which is a different construct with its own trust policy.
  • B — IAM does not support nested groups. A user can belong to multiple groups, which is how overlapping permission sets are expressed.
  • D — Groups have no credentials of any kind, so there is nothing to sign in with.

Last verified: 2026-08-28

Question 86 clf-security-fundamentals-086

Hard · Select 2 answers

Which TWO statements about AWS IAM Identity Center are correct? (Choose TWO.)

  1. a It is intended to authenticate the end users of a company's customer-facing mobile application
  2. b It requires an IAM user to be created in every account that a workforce user needs to reach
  3. c It replaces IAM, so IAM roles and policies are no longer used in the member accounts
  4. d It can use its own built-in directory, an Active Directory, or an external identity provider as the identity source
  5. e When a permission set is assigned to an account, IAM Identity Center creates and manages an IAM role in that account
Show answer & explanation

Answer: D and E

Why D and E are correct

IAM Identity Center is the recommended way to manage workforce access across many AWS accounts. One identity source feeds it, which may be its own directory, Active Directory, or an external provider such as Okta or Microsoft Entra ID, and assigning a permission set causes it to provision and keep in sync an IAM role in each target account so users receive temporary credentials.

Why the others are wrong

  • A — Consumer or customer sign-in for an application is the purpose of Amazon Cognito. Identity Center is for a company's own workforce.
  • B — Removing per-account IAM users is one of the main reasons to adopt it. Users sign in once through the access portal and reach every account they are entitled to.
  • C — It builds on IAM rather than replacing it. The access a user receives is delivered through IAM roles and evaluated by the same policy logic.

Last verified: 2026-08-28

Question 87 clf-security-fundamentals-087

Hard · Choose one

What is the security benefit of federating workforce users into AWS through an external identity provider instead of creating an IAM user for each person?

  1. a Users sign in with credentials managed in the identity provider and receive temporary AWS credentials, so there are no long-term AWS credentials for those users to rotate or leak
  2. b Permissions no longer need to be defined in AWS, because the identity provider decides what each user may do
  3. c Federation applies only to programmatic access, so console sign-in is no longer possible for those users
  4. d Users receive permanent IAM access keys that are synchronized automatically from the identity provider
Show answer & explanation

Answer: A

Why A is correct

Federation moves the credential lifecycle to a system the company already operates, so joiners and leavers are handled once, in one place. In AWS the federated user assumes a role and receives temporary credentials that expire, which removes the standing password and access keys an IAM user would otherwise carry.

Why the others are wrong

  • B — The identity provider proves who the user is; AWS still decides what they may do, through the roles and policies the federated session assumes.
  • C — Federated users can reach both the AWS Management Console and the APIs, which is why it is the recommended pattern for human access.
  • D — Federation issues short-lived credentials on demand. It does not create or synchronize permanent access keys.

Last verified: 2026-08-28

Question 88 clf-security-fundamentals-088

Easy · Choose one

Which AWS security control operates at the instance level and is stateful, meaning that return traffic for an allowed connection is permitted automatically?

  1. a A VPC network ACL
  2. b AWS WAF
  3. c AWS Shield Standard
  4. d A VPC security group
Show answer & explanation

Answer: D

Why D is correct

A security group is a virtual firewall attached to an elastic network interface. Because it is stateful, allowing an inbound request means the response is allowed out regardless of the outbound rules, which is why security groups need only describe the traffic a workload should accept.

Why the others are wrong

  • A — A network ACL operates at the subnet boundary and is stateless, so return traffic must be allowed explicitly by a rule in the opposite direction.
  • B — AWS WAF inspects the content of HTTP and HTTPS requests at the application layer rather than filtering by address and port at the instance.
  • C — AWS Shield Standard automatically mitigates common network and transport layer DDoS attacks. It is not a configurable per-instance firewall.

Last verified: 2026-08-28

Question 89 clf-security-fundamentals-089

Easy · Choose one

Where can a company find and subscribe to third-party security software, such as endpoint protection, firewalls, or SIEM tools, to deploy in its AWS environment?

  1. a AWS Service Catalog
  2. b AWS Artifact
  3. c AWS Marketplace
  4. d AWS Trusted Advisor
Show answer & explanation

Answer: C

Why C is correct

AWS Marketplace is a curated digital catalog where independent software vendors publish security products as machine images, container images, SaaS subscriptions, and professional services. Purchases flow through the customer's AWS account and appear on the same AWS invoice.

Why the others are wrong

  • A — AWS Service Catalog lets an organization publish and govern its own approved product portfolio for internal users, rather than offering third-party products for purchase.
  • B — AWS Artifact distributes AWS compliance reports and agreements. It sells no software.
  • D — AWS Trusted Advisor evaluates an account against best-practice checks and makes recommendations. It is not a procurement channel.

Last verified: 2026-08-28

Question 90 clf-security-fundamentals-090

Easy · Choose one

Where does AWS publish notices about security issues and vulnerabilities that affect AWS services, along with guidance on what customers should do?

  1. a AWS Service Catalog
  2. b AWS Security Bulletins, on the AWS security webpages
  3. c AWS Artifact
  4. d Amazon Inspector findings in the customer's account
Show answer & explanation

Answer: B

Why B is correct

AWS Security Bulletins are the official channel for security notices about AWS services, including relevant CVE identifiers and any customer action required. They are published on the AWS security pages and are available as an RSS feed, alongside the AWS Security Blog for deeper technical guidance.

Why the others are wrong

  • A — AWS Service Catalog manages an organization's approved internal product portfolio and has no security notification role.
  • C — AWS Artifact holds audit reports and agreements. It is not used to announce vulnerabilities or remediation guidance.
  • D — Amazon Inspector reports vulnerabilities found in the customer's own workloads. It does not publish AWS service-level security notices.

Last verified: 2026-08-28