AWS CLF-C02 Security and Compliance Practice Questions

Free CLF-C02 Security and Compliance practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AWS CLF-C02 page. Sign up free to practice the full set.

1. Question 1Security and Compliance

   Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?

   • APhysical security of data centers
   • BManaging security group rules and network ACLsCorrect
   • CPatching the hypervisor software
   • DMaintaining the global network infrastructure
   ✓ Correct answer: B

   Under the AWS Shared Responsibility Model, customers are responsible for security 'in' the cloud - this includes configuring security groups (stateful instance-level firewalls) and network ACLs (stateless subnet-level filters) within their VPC. These controls govern what traffic is allowed to reach their resources, and AWS never manages them on the customer's behalf. AWS is responsible for the physical infrastructure and hypervisor below these controls.

   Why the other options are wrong

   • APhysical security of data centers - including perimeter security, badge access, surveillance, and hardware disposal - is entirely AWS's responsibility as part of its security 'of' the cloud obligations.
   • CPatching the hypervisor software is AWS's responsibility; AWS manages the virtualization layer that underlies EC2 instances, and customers never have access to or responsibility for the hypervisor.
   • DMaintaining the global network infrastructure - including fiber cables, routers, and backbone hardware connecting AWS Regions and Edge Locations - is AWS's responsibility, not the customer's.
2. Question 2Security and Compliance

   A customer runs an application on an Amazon EC2 instance. Under the shared responsibility model, who must apply operating system patches to that instance?

   • AAWS, as part of managing the physical hardware and facilities.
   • BThe customer, who manages the instance's guest operating system.Correct
   • CAWS, because EC2 is treated as a fully managed service.
   • DNo one, since EC2 instances never require any patching.
   ✓ Correct answer: B

   With EC2, AWS handles the physical hardware, hypervisor, and facilities, while the customer manages the guest operating system, including patching, along with applications and data. EC2 is infrastructure as a service, so OS maintenance falls to the customer. Fully managed services such as RDS handle OS patching for you.

   Why the other options are wrong

   • AAWS manages the hardware but not the guest OS on EC2 instances.
   • CEC2 is not fully managed; the customer manages the OS and above.
   • DOperating systems do require patching to stay secure and up to date.
3. Question 3Security and Compliance

   A company stores sensitive customer data in Amazon S3 and needs to automatically discover, classify, and protect sensitive data such as personally identifiable information (PII). Which AWS service should they use?

   • AAmazon GuardDuty
   • BAmazon Inspector
   • CAWS Config
   • DAmazon MacieCorrect
   ✓ Correct answer: D

   Amazon Macie automatically discovers, classifies, and protects sensitive data such as personally identifiable information (PII) stored in S3. It uses machine learning to identify sensitive data patterns, assigns data classifications, and can generate alerts or block access to sensitive data. Macie provides dashboards showing data discovery findings and recommendations for protecting sensitive data, making it the ideal service for data protection and compliance.

   Why the other options are wrong

   • AAmazon GuardDuty is incorrect because Amazon GuardDuty detects threats and malicious activity, not sensitive data. It does not discover or classify PII in S3.
   • BAmazon Inspector is incorrect because Amazon Inspector performs vulnerability assessments on EC2 instances and Lambda functions. It does not discover or classify sensitive data in S3.
   • CAWS Config is incorrect because AWS Config monitors resource configuration compliance. It does not discover, classify, or protect sensitive data in S3.
4. Question 4Security and Compliance

   An organization has multiple AWS accounts for different departments (development, testing, production). The IT director wants to centrally manage security policies and consolidated billing across all accounts. Which AWS service should be used?

   • AAWS OrganizationsCorrect
   • BAWS Control Tower
   • CAmazon Cognito
   • DAWS IAM
   ✓ Correct answer: A

   AWS Organizations allows you to centrally manage multiple AWS accounts, enforce policies across accounts, and consolidate billing. It enables centralized security policy management and provides a consolidated view of costs across all accounts in your organization.

   Why the other options are wrong

   • BAWS Control Tower is incorrect because AWS Control Tower automates account setup but is for landing zone establishment, not centralized policy management.
   • CAmazon Cognito is incorrect because Amazon Cognito manages user authentication, not AWS account management.
   • DAWS IAM is incorrect because AWS IAM manages access within a single account, not across multiple accounts.
5. Question 5Security and Compliance

   What is a benefit of using IAM groups to assign permissions?

   • AThey grant temporary credentials to AWS services
   • BThey apply one policy set to many users at onceCorrect
   • CThey remove the requirement to enable MFA on users
   • DThey encrypt data that users store in Amazon S3
   ✓ Correct answer: B

   An IAM group is a collection of IAM users, and policies attached to the group apply to all its members. This makes it easy to grant a consistent set of permissions, such as to all developers, and to update them in one place. Adding or removing a user from a group instantly adjusts their access.

   Why the other options are wrong

   • AProviding temporary credentials to AWS services is the function of IAM roles, not groups.
   • CGroups do not replace MFA; MFA is a separate authentication control.
   • DEncrypting S3 data is done with KMS or S3 encryption settings, not IAM groups.
6. Question 6Security and Compliance

   A company needs to grant temporary access to AWS resources for users federated from a corporate identity provider. Which feature should they use?

   • AIAM users with long-term access keys
   • BIAM roles with temporary security credentialsCorrect
   • CIAM groups with attached policies
   • DRoot account credentials
   ✓ Correct answer: B

   Federated users do not need an IAM identity of their own. The corporate identity provider authenticates the user, and they assume an IAM role through AWS STS, receiving temporary credentials that expire automatically after a defined period. Nothing long-lived is created or has to be revoked when someone leaves, permissions come from the role rather than from per-user policies, and the identity provider stays the single source of truth for who exists. Role sessions are still attributed in CloudTrail.

   Why the other options are wrong

   • AIAM users with long-term access keys create a second identity store to maintain and keys that persist until someone deletes them, which is what federation is meant to avoid.
   • CIAM groups organise users for policy attachment. They do not provide temporary credentials and still require the users to exist in IAM.
   • DRoot account credentials have unlimited permissions, cannot be scoped, and must never be shared or used for routine access.
7. Question 7Security and Compliance

   Which AWS service allows you to create and manage a set of rules that automatically evaluate whether your AWS resources are configured according to your desired configurations?

   • AAWS CloudTrail
   • BAmazon Inspector
   • CAWS Config RulesCorrect
   • DAWS Trusted Advisor
   ✓ Correct answer: C

   AWS Config Rules allow you to define desired configuration states for your AWS resources and automatically evaluate whether resources comply with those rules on an ongoing basis. Rules can be AWS-managed or custom (using Lambda functions), and violations trigger findings that can alert teams or trigger automated remediation. This continuous compliance monitoring is distinct from one-time audits and covers resources as they change over time.

   Why the other options are wrong

   • AAWS CloudTrail records API call history and user activity for auditing purposes but does not evaluate whether resource configurations conform to desired settings or policies.
   • BAmazon Inspector is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure, not a configuration compliance evaluation tool.
   • DAWS Trusted Advisor provides best-practice recommendations across cost, performance, security, and fault tolerance categories, but it does not allow you to define and enforce custom configuration rules.
8. Question 8Security and Compliance

   In AWS IAM, what determines the specific actions and resources that an identity is allowed or denied access to?

   • AIAM policiesCorrect
   • BThe AWS Region selected
   • CThe instance type of the resource
   • DThe billing plan for the account
   ✓ Correct answer: A

   IAM policies are JSON documents that specify permissions by defining which actions are allowed or denied on which resources, and under what conditions. Policies can be attached to users, groups, or roles to grant those identities their permissions. The effective permissions of any identity are the result of the policies that apply to it.

   Why the other options are wrong

   • BThe selected Region affects where resources run, not what an identity may do.
   • CInstance type relates to compute capacity, not IAM permissions.
   • DThe billing plan does not determine access permissions.

How Security and Compliance is tested

This domain holds 257 of the 849 questions in the CLF-C02 bank, about 30%. The mix is 227 single-answer multiple choice, 29 multiple-response and 1 yes/no scenario, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Security and Compliance on its own rather than re-running full-length mocks.

Other CLF-C02 exam domains

• Cloud Concepts205 questions
• Cloud Technology and Services282 questions
• Billing, Pricing, and Support105 questions
• All CLF-C02 practice questions849 total
• Security and Compliance study notesKey concepts
• AWS practice examsAll AWS

CLF-C02 Security and Compliance FAQ