Skip to content

AWS CLF-C02 Exam Notes

Task Statement 2.2: Understand AWS Cloud security, governance, and compliance concepts

Practice Questions (20)
These questions follow the official AWS Certified Cloud Practitioner (CLF-C02) style and difficulty. They cover the knowledge and skills listed in the exam guide plus the key points from the official review lesson transcript.

Question 1

A company needs on-demand access to AWS security and compliance reports and select online agreements. Which AWS service should the company use?

A. AWS Artifact
B. AWS Trusted Advisor
C. Amazon Inspector
D. AWS Config

Click to reveal answer **Correct Answer: A** **Explanation:** AWS Artifact provides on-demand access to AWS security and compliance documents (SOC reports, PCI, ISO, etc.) and agreements. - **Exam tip / trap:** Do not confuse Artifact with Trusted Advisor (best-practice checks) or Config (resource configuration history). - Keyword: “on-demand access to compliance reports/documents” → always Artifact.

Question 2

Which of the following statements about encryption on AWS is correct? (Select TWO.)

A. Encryption of data at rest protects data while it is stored.
B. Encryption of data in transit protects data while it moves between locations.
C. All AWS services automatically encrypt data at rest with no customer action.
D. Customers are never responsible for enabling encryption.
E. Encryption is only available in a single AWS Region.

Click to reveal answer **Correct Answers: A, B** **Explanation:** - Data at rest = stored data. - Data in transit = data moving between systems (TLS/SSL, etc.). Customers often must enable encryption (shared responsibility), and encryption is available in multiple Regions. - **Exam tip:** Always distinguish “at rest” vs “in transit.” - Trap: Assuming every service encrypts by default with zero customer action.

Question 3

A security team wants a managed threat-detection service that continuously monitors for malicious activity and unauthorized behavior in their AWS accounts. Which service should they choose?

A. Amazon GuardDuty
B. AWS Shield
C. AWS WAF
D. Amazon Inspector

Click to reveal answer **Correct Answer: A** **Explanation:** Amazon GuardDuty is the intelligent threat-detection service that analyzes CloudTrail, VPC Flow Logs, and DNS logs for malicious activity. - Shield = DDoS protection - WAF = web-application firewall - Inspector = vulnerability assessments - **Keyword trap:** “threat detection / malicious activity / unauthorized behavior” → GuardDuty.

Question 4

Which AWS service helps protect applications running on AWS from common Distributed Denial of Service (DDoS) attacks?

A. AWS Shield
B. Amazon GuardDuty
C. AWS WAF
D. AWS Firewall Manager

Click to reveal answer **Correct Answer: A** **Explanation:** AWS Shield (Standard is free and automatic; Advanced is paid) provides managed DDoS protection. - **Exam tip:** “DDoS” is almost always Shield. - WAF protects against application-layer exploits (SQL injection, XSS), not primarily volumetric DDoS.

Question 5

An auditor needs to know which IAM user deleted an Amazon EC2 instance in the production account last week. Which service provides this information?

A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Config
D. AWS Trusted Advisor

Click to reveal answer **Correct Answer: B** **Explanation:** AWS CloudTrail records API calls (who, what, when, where) and is the primary service for governance, compliance, and operational auditing. - CloudWatch = metrics & logs monitoring - Config = resource configuration history & compliance - **Classic exam question:** “Who performed an action?” → CloudTrail.

Question 6

A company wants to continuously monitor and record AWS resource configurations and evaluate them against desired configurations. Which service should it use?

A. AWS Config
B. AWS CloudTrail
C. Amazon CloudWatch
D. AWS Artifact

Click to reveal answer **Correct Answer: A** **Explanation:** AWS Config tracks configuration changes, maintains an inventory, and can evaluate resources against rules (compliance). - **Keyword:** “configuration history / desired configuration / inventory” → Config.

Question 7

Which statements correctly describe compliance on AWS? (Select TWO.)

A. Compliance requirements can vary from one AWS service to another.
B. Every AWS service is automatically compliant with every global regulation.
C. Customers can find compliance information and reports in AWS Artifact.
D. Only AWS is responsible for compliance of customer applications.
E. Compliance is only relevant for companies in the healthcare industry.

Click to reveal answer **Correct Answers: A, C** **Explanation:** Transcript and exam guide emphasize that compliance requirements differ by service and that AWS Artifact is the place to obtain official compliance documentation. - Trap: Believing “all services are automatically compliant with everything.”

Question 8

A company must ensure its solution meets GDPR requirements and wants to confirm whether Amazon DynamoDB can be used in a GDPR-compliant architecture. Where should the company look first?

A. AWS Artifact
B. Amazon DynamoDB console
C. AWS Personal Health Dashboard
D. AWS Pricing Calculator

Click to reveal answer **Correct Answer: A** **Explanation:** AWS Artifact contains the compliance reports and certifications that show which services are covered under which programs (including GDPR-related documentation). - **Exam tip:** Any “where do I find compliance reports / attestations?” → Artifact.

Question 9

Which service is a web application firewall that helps protect web applications from common exploits that could affect availability, compromise security, or consume excessive resources?

A. AWS WAF
B. AWS Shield
C. Amazon GuardDuty
D. AWS Network Firewall

Click to reveal answer **Correct Answer: A** **Explanation:** AWS WAF is specifically designed to protect web applications from common web exploits (OWASP Top 10, etc.). - Shield = DDoS - GuardDuty = threat detection

Question 10

A Cloud Practitioner needs to collect operational metrics and logs from EC2 instances and set alarms when CPU utilization exceeds 80 %. Which service should be used?

A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Config
D. Amazon Inspector

Click to reveal answer **Correct Answer: A** **Explanation:** Amazon CloudWatch is the monitoring and observability service for metrics, logs, and alarms. - CloudTrail = API activity - Config = configuration - **Keyword:** “metrics / alarms / operational data” → CloudWatch.

Question 11

Which of the following are AWS security services that help customers secure their resources? (Select TWO.)

A. Amazon Inspector
B. AWS Security Hub
C. AWS Elastic Beanstalk
D. Amazon QuickSight
E. AWS CloudFormation

Click to reveal answer **Correct Answers: A, B** **Explanation:** - Amazon Inspector = automated vulnerability management. - AWS Security Hub = centralized security and compliance posture management. The other services are not primarily security tools.

Question 12

What is the BEST way to keep a complete record of all account activity across every AWS Region with AWS CloudTrail?

A. Create a multi-Region trail
B. Enable CloudTrail only in us-east-1
C. Use Amazon CloudWatch Logs exclusively
D. Turn on AWS Config in one Region

Click to reveal answer **Correct Answer: A** **Explanation:** A multi-Region CloudTrail trail captures events from all Regions in a single trail (recommended best practice). - Transcript explicitly mentions “create a CloudTrail trail for multi-Regions.”

Question 13

According to the AWS shared responsibility model, which of the following encryption-related tasks is typically the customer’s responsibility?

A. Enabling encryption for data stored in Amazon S3
B. Maintaining the physical security of the data centers
C. Patching the hypervisor
D. Destroying decommissioned hard drives

Click to reveal answer **Correct Answer: A** **Explanation:** Customers are responsible for enabling and managing encryption of their data (at rest and in transit) for most services. AWS is responsible for the underlying infrastructure. - Classic shared-responsibility exam question.

Question 14

A company wants a single place to view security alerts and security posture across multiple AWS accounts. Which service provides this capability?

A. AWS Security Hub
B. Amazon GuardDuty
C. AWS Shield
D. Amazon Detective

Click to reveal answer **Correct Answer: A** **Explanation:** AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie, and other services into a single dashboard and also runs automated compliance checks.

Question 15

Which service can automatically assess applications for exposure, vulnerabilities, and deviations from best practices?

A. Amazon Inspector
B. AWS WAF
C. AWS CloudTrail
D. Amazon CloudWatch

Click to reveal answer **Correct Answer: A** **Explanation:** Amazon Inspector is the automated vulnerability-management service that scans EC2, Lambda, and container workloads.

Question 16

Where are AWS CloudTrail logs commonly stored for long-term retention and analysis?

A. Amazon S3
B. Amazon EC2 instance store
C. Amazon EBS snapshots only
D. AWS Snowball

Click to reveal answer **Correct Answer: A** **Explanation:** CloudTrail trails deliver log files to an Amazon S3 bucket (and optionally to CloudWatch Logs). S3 is the durable, long-term storage location. - **Exam tip:** “Where are CloudTrail logs stored?” → S3.

Question 17

Which of the following are benefits of using encryption in the AWS Cloud? (Select TWO.)

A. Protects data confidentiality
B. Helps meet compliance requirements
C. Automatically increases EC2 instance CPU performance
D. Eliminates the need for security groups
E. Removes the customer’s responsibility under the shared responsibility model

Click to reveal answer **Correct Answers: A, B** **Explanation:** Encryption protects data confidentiality and is frequently required for compliance standards (PCI-DSS, HIPAA, GDPR, etc.). It does not improve performance or remove customer responsibility.

Question 18

A company operates in multiple countries and must choose AWS Regions that help it meet local data-residency and compliance requirements. What should the company do?

A. Review AWS compliance programs and choose Regions accordingly
B. Use only the us-east-1 Region for all workloads
C. Disable encryption so data can move freely
D. Rely solely on AWS Shield for compliance

Click to reveal answer **Correct Answer: A** **Explanation:** Customers must understand compliance needs among geographic locations and industries and select Regions that support the required compliance programs. AWS Artifact and the AWS Compliance Center provide this information.

Question 19

Which service helps organizations continuously audit their AWS usage to simplify risk assessment and compliance?

A. AWS Audit Manager
B. Amazon QuickSight
C. AWS Cost Explorer
D. Amazon Macie

Click to reveal answer **Correct Answer: A** **Explanation:** AWS Audit Manager automates evidence collection for audits and helps map controls to compliance frameworks. It was mentioned in the transcript as a governance/compliance aid.

Question 20

A Cloud Practitioner is reviewing services that support governance and compliance. Which pair of services is correctly matched with its primary purpose?

A. AWS CloudTrail → API call auditing; Amazon CloudWatch → monitoring metrics and logs
B. AWS Config → DDoS protection; AWS Shield → configuration history
C. Amazon GuardDuty → web-application firewall; AWS WAF → threat detection
D. AWS Artifact → vulnerability scanning; Amazon Inspector → compliance reports

Click to reveal answer **Correct Answer: A** **Explanation:** - CloudTrail = governance, compliance, and auditing of account activity (API calls). - CloudWatch = monitoring and operational data. All other pairings are reversed or incorrect. - **Exam tip:** Memorize the core purpose of CloudTrail, Config, CloudWatch, GuardDuty, Shield, WAF, Inspector, Security Hub, and Artifact.

End of 20-question set for Task Statement 2.2

Quick Revision Checklist (from transcript + exam guide)

  • Artifact = compliance reports
  • CloudTrail = “who did what”
  • Config = “what does my resource look like / is it compliant?”
  • CloudWatch = metrics & alarms
  • GuardDuty = threat detection
  • Shield = DDoS
  • WAF = web exploits
  • Inspector & Security Hub = vulnerability & posture
  • Encryption at rest vs in transit
  • Compliance varies by service and by Region