Security Fundamentals — CLF-C02 practice questions

Practice questions for this topic, with explained answers.

Domain: Security and Compliance ·100 questions · 30 easy · 40 intermediate · 30 hard · page 7 of 7

Question 91 clf-security-fundamentals-091

Easy · Choose one

What is the primary purpose of AWS Certificate Manager?

  1. a To distribute AWS compliance reports to a company's auditors
  2. b To provision, manage, and automatically renew SSL/TLS certificates for use with AWS services
  3. c To create and control the encryption keys that protect data at rest
  4. d To store database credentials and rotate them automatically
Show answer & explanation

Answer: B

Why B is correct

AWS Certificate Manager issues and manages the TLS certificates that enable encryption in transit. Public certificates for use with integrated AWS services such as Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway are provided at no cost, and ACM renews the certificates it issued before they expire.

Why the others are wrong

  • A — AWS compliance reports are obtained from AWS Artifact.
  • C — Creating and controlling keys for data at rest is the role of AWS Key Management Service.
  • D — Storing and rotating credentials is the role of AWS Secrets Manager.

Last verified: 2026-08-28

Question 92 clf-security-fundamentals-092

Intermediate · Choose one

A company needs to let another AWS account in the same AWS Organizations organization use a subnet in a VPC that the company owns, without recreating the network in the other account. Which service enables this?

  1. a AWS Certificate Manager
  2. b AWS Directory Service
  3. c AWS Resource Access Manager (AWS RAM)
  4. d AWS Organizations consolidated billing
Show answer & explanation

Answer: C

Why C is correct

AWS RAM lets a resource owner share supported resources with other accounts, organizational units, or an entire organization. VPC subnets are shareable only with accounts in the same organization, while resources such as AWS Transit Gateway and AWS License Manager configurations can also be shared with accounts outside it. Sharing avoids duplicating infrastructure while the owner keeps control of the resource.

Why the others are wrong

  • A — AWS Certificate Manager issues and manages TLS certificates, which is unrelated to cross-account resource sharing.
  • B — AWS Directory Service provides managed Active Directory capabilities and has no role in sharing network resources.
  • D — Consolidated billing combines the charges of member accounts onto one invoice. It does not share technical resources between them.

Last verified: 2026-08-28

Question 93 clf-security-fundamentals-093

Intermediate · Choose one

Which statement about a VPC network ACL is correct?

  1. a It applies to individual instances rather than to entire subnets
  2. b It supports allow rules only and evaluates every rule before deciding whether to permit traffic
  3. c It is stateful, so return traffic for an allowed connection is permitted automatically
  4. d It is stateless, applies at the subnet level, supports both allow and deny rules, and evaluates rules in numerical order until one matches
Show answer & explanation

Answer: D

Why D is correct

Network ACLs are the subnet-level layer of VPC network security and behave very differently from security groups. Being stateless, they need matching rules in both directions, including the ephemeral port range for responses, and their numbered rules are evaluated lowest number first with the first match deciding the outcome.

Why the others are wrong

  • A — Instance-level filtering is what a security group does. A network ACL is associated with subnets.
  • B — Allow-only rules evaluated as a whole describe a security group. The ability to write explicit deny rules is a key reason to use a network ACL, for example to block a specific address range.
  • C — Statefulness is the defining property of a security group, not of a network ACL.

Last verified: 2026-08-28

Question 94 clf-security-fundamentals-094

Intermediate · Choose one

A company wants to block requests originating from specific countries and to rate-limit requests to a public API so that a single client cannot overwhelm it. Which service provides these controls?

  1. a A VPC security group attached to the API
  2. b AWS WAF, using rules in a web ACL associated with the API
  3. c Amazon GuardDuty, which blocks traffic from malicious source addresses
  4. d AWS Shield Standard, which is enabled automatically for all customers
Show answer & explanation

Answer: B

Why B is correct

AWS WAF evaluates each HTTP or HTTPS request against the rules in a web ACL and can allow, block, count, or challenge it. Geographic match rules and rate-based rules are both native rule types, alongside managed rule groups that cover common exploits such as SQL injection and cross-site scripting.

Why the others are wrong

  • A — A security group attaches to an elastic network interface and cannot be associated with an Amazon API Gateway API at all. Even where it does apply, it filters on IP address, protocol, and port and cannot count requests over time or evaluate the country a request came from.
  • C — Amazon GuardDuty is a detection service. It generates findings about suspicious activity and does not block or filter traffic.
  • D — AWS Shield Standard mitigates common network and transport layer DDoS attacks automatically, but it offers no configurable application-layer rules.

Last verified: 2026-08-28

Question 95 clf-security-fundamentals-095

Intermediate · Choose one

What does the DDoS cost protection feature of AWS Shield Advanced provide?

  1. a Service credits for the scaling charges caused by a DDoS-driven usage spike on protected resources
  2. b A refund of the Shield Advanced subscription fee if an attack succeeds in disrupting the application
  3. c A hard cap on AWS WAF request charges for the duration of an attack
  4. d Free AWS Support for the duration of a DDoS event
Show answer & explanation

Answer: A

Why A is correct

An attack drives up usage even when it is successfully mitigated, because the application scales out and transfers more data. DDoS cost protection requests service credits for those charges on protected resources such as Amazon EC2, Elastic Load Balancing, Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53, so a customer is not billed for absorbing an attack.

Why the others are wrong

  • B — The subscription fee is not refunded. The protection concerns usage charges caused by the attack.
  • C — There is no charge cap. Shield Advanced does include AWS WAF usage on protected resources at no extra cost, which is a separate benefit from cost protection.
  • D — Access to the Shield Response Team is a Shield Advanced benefit but depends on the account's AWS Support plan, and it is not what cost protection means.

Last verified: 2026-08-28

Question 96 clf-security-fundamentals-096

Intermediate · Choose one

Which statement correctly contrasts Amazon GuardDuty with Amazon Inspector?

  1. a Both scan for software vulnerabilities, but GuardDuty covers only container images
  2. b GuardDuty detects malicious or unauthorized activity by analyzing logs, while Inspector scans workloads for software vulnerabilities and unintended network exposure
  3. c Both analyze activity logs, but Inspector additionally aggregates the findings that GuardDuty produces
  4. d GuardDuty scans workloads for software vulnerabilities, while Inspector detects malicious activity by analyzing logs
Show answer & explanation

Answer: B

Why B is correct

The two answer different questions. GuardDuty continuously analyzes activity such as CloudTrail management events, VPC Flow Logs, and DNS logs to find behavior that suggests compromise, while Inspector examines the software present in EC2 instances, container images, and Lambda functions to find known vulnerabilities before they are exploited.

Why the others are wrong

  • A — GuardDuty performs no vulnerability scanning at all, and Inspector's coverage extends well beyond container images.
  • C — Aggregating findings from multiple security services into one view is the role of AWS Security Hub, not Inspector.
  • D — This reverses the two services. Vulnerability scanning is Inspector's function and log-based threat detection is GuardDuty's.

Last verified: 2026-08-28

Question 97 clf-security-fundamentals-097

Hard · Select 2 answers

Which TWO resources can an AWS WAF web ACL be associated with directly? (Choose TWO.)

  1. a A Network Load Balancer
  2. b An Amazon EBS volume
  3. c An Amazon EC2 instance
  4. d An Application Load Balancer
  5. e An Amazon CloudFront distribution
Show answer & explanation

Answer: D and E

Why D and E are correct

AWS WAF protects resources that terminate and understand HTTP, which is why it attaches to layer 7 entry points such as CloudFront distributions, Application Load Balancers, Amazon API Gateway REST APIs, and Amazon Cognito user pools. Traffic reaching an application through one of these is inspected before it is forwarded.

Why the others are wrong

  • A — A Network Load Balancer operates at layer 4 and does not parse HTTP, so a web ACL cannot be associated with it. Workloads behind an NLB are usually fronted by CloudFront or an ALB when AWS WAF is needed.
  • B — An Amazon EBS volume is block storage and carries no network traffic to inspect.
  • C — AWS WAF is never attached to an instance. Instance-level filtering by address and port is the job of a security group.

Last verified: 2026-08-28

Question 98 clf-security-fundamentals-098

Hard · Choose one

A team creates a new custom security group and a new custom network ACL, associates the network ACL with a subnet, and attaches the security group to an Amazon EC2 instance in that subnet, without adding any rules to either. What is the resulting behavior?

  1. a The security group allows all outbound traffic and no inbound traffic, while the custom network ACL denies all inbound and outbound traffic
  2. b Both allow all traffic in both directions until rules are added
  3. c The security group denies all traffic in both directions, while the network ACL allows all traffic in both directions
  4. d Both deny all traffic in both directions until rules are added
Show answer & explanation

Answer: A

Why A is correct

The two constructs have different starting positions, and knowing them prevents a lot of wasted troubleshooting. A newly created security group contains one outbound rule permitting all traffic and no inbound rules, whereas a newly created network ACL contains only the final deny rules, so it blocks everything until explicit numbered rules are added in both directions.

Why the others are wrong

  • B — This describes the default network ACL, which permits all traffic, rather than a custom one. A new security group also never permits inbound traffic by default.
  • C — This reverses both behaviors, and the allow-all description applies to the default network ACL rather than a custom one.
  • D — The security group permits all outbound traffic from the moment it is created, so traffic is not blocked in both directions.

Last verified: 2026-08-28

Question 99 clf-security-fundamentals-099

Hard · Choose one

A company imports a third-party SSL/TLS certificate into AWS Certificate Manager and associates it with an Application Load Balancer. What must the company plan for?

  1. a Renewing the certificate with the issuing authority and re-importing it before it expires, because ACM does not automatically renew imported certificates
  2. b Nothing further, because ACM renews imported certificates in the same way as the certificates it issues
  3. c Re-importing the certificate into the US East (N. Virginia) Region so the load balancer can use it
  4. d A monthly per-certificate charge for keeping the imported certificate in ACM
Show answer & explanation

Answer: A

Why A is correct

Managed renewal applies only to certificates that ACM itself issued, because only then does ACM control the validation and issuance process. An imported certificate is opaque to ACM, so tracking its expiry and repeating the import is the customer's responsibility, and ACM can send expiry notifications to help.

Why the others are wrong

  • B — Automatic renewal of an imported certificate is impossible, since ACM has no relationship with the external certificate authority that issued it.
  • C — The US East (N. Virginia) requirement applies to certificates used with Amazon CloudFront. A certificate for an Application Load Balancer must be in the same Region as the load balancer.
  • D — Importing a certificate into ACM carries no charge. Costs arise from AWS Private CA when issuing private certificates.

Last verified: 2026-08-28

Question 100 clf-security-fundamentals-100

Hard · Choose one

A security team suspects that an AWS KMS customer managed key may have been used by a compromised application. They must stop the key being used immediately while the investigation continues, but must not lose the ability to decrypt existing data later. What should they do?

  1. a Disable the key, which prevents it from being used for cryptographic operations while preserving it and its key material
  2. b Rotate the key material, which prevents the key from being used until rotation completes
  3. c Schedule the key for deletion, which takes effect immediately and can be undone at any time afterwards
  4. d Delete the alias that points to the key, which removes access to the key
Show answer & explanation

Answer: A

Why A is correct

Disabling a key makes AWS KMS reject every request to use it, so encryption and decryption stop at once, and the key and its material remain intact. If the investigation clears the application, the key is simply re-enabled and data protected by it becomes readable again.

Why the others are wrong

  • B — Rotation creates new backing key material for future encryption while retaining the old material. It does not block the key from being used and is not a containment action.
  • C — Scheduling deletion starts a mandatory waiting period, and once the key is deleted the data it protects is unrecoverable. Deletion can be cancelled during the waiting period but is far riskier than disabling.
  • D — An alias is only a friendly name. Removing it does not stop anything that references the key by its key ID or ARN.

Last verified: 2026-08-28