AWS Certified Cloud Practitioner (CLF-C02) Exam Notes

Task Statement 2.4: Identify components and resources for security

Knowledge of: Security capabilities that AWS provides • Security-related documentation that AWS provides

Skills in: Describing AWS security features and services (AWS WAF, AWS Firewall Manager, AWS Shield, Amazon GuardDuty) • Understanding third-party security products from AWS Marketplace • Identifying where AWS security information is available (AWS Knowledge Center, AWS Security Center, AWS Security Blog) • Understanding the use of AWS services for identifying security issues (AWS Trusted Advisor)

Below are 20 exam-style questions aligned to the official task statement and the provided video transcript. Questions match CLF-C02 foundation-level difficulty.

Question 1

A company wants to control inbound and outbound traffic at the subnet level inside an Amazon VPC. Which AWS feature should they use?

A. Security groups
B. Network ACLs
C. AWS WAF
D. Amazon GuardDuty

Click to reveal answer

**Correct Answer: B** **Explanation:** Network ACLs (NACLs) act as a firewall for controlling traffic entering or leaving a subnet. They are associated with the subnet, not individual resources. **Exam tip / trap:** Security groups operate at the Elastic Network Interface (ENI) / resource level, not the subnet level. Keywords: “subnet level” or “subnet boundary” → NACL.

Question 2

Which statement correctly describes the difference between security groups and network ACLs?

A. Security groups are stateless; network ACLs are stateful.
B. Security groups are stateful; network ACLs are stateless.
C. Both are stateful.
D. Both are stateless.

Click to reveal answer

**Correct Answer: B** **Explanation:** Security groups are stateful (if traffic is allowed in, the return traffic is automatically allowed). Network ACLs are stateless (you must explicitly allow both inbound and outbound rules). **Exam tip / trap:** Remember “Security groups = Stateful” (both start with S). If a question mentions needing separate inbound + outbound rules, it is describing NACLs.

Question 3

A security team needs to explicitly deny specific IP addresses from reaching resources in a subnet. Which feature must they use?

A. Security groups
B. Network ACLs
C. AWS Shield
D. Amazon Inspector

Click to reveal answer

**Correct Answer: B** **Explanation:** Security groups support only allow rules and have an implicit deny. They cannot explicitly deny traffic. Network ACLs support both allow and deny rules. **Exam tip / trap:** Keyword “explicitly deny” almost always points to Network ACLs. Security groups = allow only + implicit deny.

Question 4

Two Amazon EC2 instances in the same subnet need to communicate with each other. Which statement is true?

A. Network ACLs will evaluate the traffic.
B. Network ACLs will have no involvement.
C. AWS WAF will filter the traffic.
D. AWS Shield Standard will block the traffic by default.

Click to reveal answer

**Correct Answer: B** **Explanation:** Network ACLs only manage traffic that crosses the subnet boundary. Traffic between two instances in the same subnet never crosses that boundary, so NACLs are not involved. Security groups (at the ENI level) still apply. **Exam tip / trap:** “Same subnet” or “not crossing subnet boundary” → NACL not involved.

Question 5

Which AWS service lets you create rules to filter web traffic based on IP addresses, HTTP headers, or URI strings and can block common attacks such as SQL injection and cross-site scripting (XSS)?

A. AWS Shield
B. AWS WAF
C. Amazon GuardDuty
D. Network ACLs

Click to reveal answer

**Correct Answer: B** **Explanation:** AWS WAF is a web application firewall that protects web applications with custom rules and managed rule sets for common exploits (SQL injection, XSS, etc.). **Exam tip / trap:** Keywords “SQL injection”, “XSS”, “HTTP headers”, “web traffic” → AWS WAF. Do not confuse with Shield (DDoS) or GuardDuty (threat detection).

Question 6

A company wants automatic protection against common and most sophisticated DDoS attacks on their web applications running on AWS. Which service provides this protection at no additional charge for all AWS customers?

A. AWS WAF
B. AWS Shield Standard
C. AWS Firewall Manager
D. Amazon GuardDuty

Click to reveal answer

**Correct Answer: B** **Explanation:** AWS Shield Standard provides always-on network flow monitoring and automatic inline mitigation against common DDoS attacks at no extra cost. AWS Shield Advanced is a paid tier for higher levels of protection. **Exam tip / trap:** “DDoS” + “no additional charge” or “included” → Shield Standard. Shield Advanced is the paid upgrade.

Question 7

Which AWS service is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning and anomaly detection?

A. Amazon Inspector
B. Amazon GuardDuty
C. AWS Trusted Advisor
D. AWS WAF

Click to reveal answer

**Correct Answer: B** **Explanation:** Amazon GuardDuty is an intelligent threat detection service that analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify unexpected and potentially unauthorized activity. **Exam tip / trap:** Keywords “threat detection”, “malicious activity”, “machine learning” → GuardDuty. Inspector = vulnerability assessment; Trusted Advisor = best-practice checks.

Question 8

A large organization wants to centrally configure and manage AWS WAF rules, AWS Shield Advanced protections, and VPC security groups across multiple AWS accounts. Which service should they use?

A. AWS Firewall Manager
B. Amazon GuardDuty
C. AWS Security Hub
D. AWS Config

Click to reveal answer

**Correct Answer: A** **Explanation:** AWS Firewall Manager is a security management service that allows centralized configuration and management of firewall rules (WAF, Shield Advanced, security groups, Network Firewall) across accounts and applications. **Exam tip / trap:** Keyword “centrally manage” + WAF/Shield/security groups → Firewall Manager.

Question 9

Where can a customer find third-party security software and appliances that can be deployed directly into their AWS account?

A. AWS Knowledge Center
B. AWS Marketplace
C. AWS Security Blog
D. AWS Trusted Advisor

Click to reveal answer

**Correct Answer: B** **Explanation:** AWS Marketplace offers a wide selection of third-party security products (firewalls, IDS/IPS, SIEM, vulnerability scanners, etc.) that can be quickly deployed. **Exam tip / trap:** Any question about “third-party security products” or “partner solutions” → AWS Marketplace.

Question 10

A Cloud Practitioner needs quick answers to common security-related questions about AWS services. Which resource should they use first?

A. AWS Security Blog
B. AWS Knowledge Center
C. AWS Whitepapers
D. AWS Artifact

Click to reveal answer

**Correct Answer: B** **Explanation:** The AWS Knowledge Center contains the most frequent questions and requests from AWS customers along with expert answers (including many security topics). **Exam tip / trap:** “Common questions / FAQs / quick answers” → Knowledge Center. Security Blog = deeper articles; Whitepapers = comprehensive guides.

Question 11

Which of the following are valid sources for AWS security information and best practices? (Choose TWO.)

A. AWS Security Center
B. AWS Security Blog
C. Amazon S3 public buckets
D. AWS Support Forum (Security)
E. EC2 instance metadata

Click to reveal answer

**Correct Answer: A, B** (also D is acceptable; any two of A, B, D) **Explanation:** AWS provides security information through the AWS Security Center, AWS Security Blog, AWS Knowledge Center, AWS Security Forum, official documentation, and whitepapers. **Exam tip / trap:** Know the official channels listed in the exam guide: Knowledge Center, Security Center, Security Blog. Avoid choosing operational resources like S3 or instance metadata.

Question 12

Which AWS service provides real-time guidance to help provision resources following AWS best practices, including security checks such as open security groups or exposed access keys?

A. Amazon Inspector
B. AWS Trusted Advisor
C. Amazon GuardDuty
D. AWS WAF

Click to reveal answer

**Correct Answer: B** **Explanation:** AWS Trusted Advisor inspects the AWS environment and makes recommendations across cost optimization, performance, security, fault tolerance, and service limits. Security checks are available (some require Business/Enterprise Support). **Exam tip / trap:** “Best practice recommendations” or “security checks” at a high level → Trusted Advisor. Very common CLF question.

Question 13

A company wants an automated security assessment service that helps improve the security and compliance of applications deployed on AWS by identifying vulnerabilities and deviations from best practices. Which service should they choose?

A. Amazon GuardDuty
B. Amazon Inspector
C. AWS Shield
D. AWS Firewall Manager

Click to reveal answer

**Correct Answer: B** **Explanation:** Amazon Inspector automatically assesses applications for vulnerabilities, exposure, and deviations from best practices (especially on EC2 and container workloads). **Exam tip / trap:** “Vulnerability assessment” or “security assessment of applications” → Inspector. GuardDuty = threat detection (runtime), Inspector = assessment.

Question 14

Can a customer perform security assessments and penetration testing against their own AWS resources without prior AWS approval?

A. No, prior approval is always required.
B. Yes, for all AWS services.
C. Yes, but only for certain permitted services.
D. Only if they have an Enterprise Support plan.

Click to reveal answer

**Correct Answer: C** **Explanation:** AWS allows customers to perform penetration testing on a defined list of services without prior approval. For other services, approval is still required. Customers must follow the AWS Customer Support Policy for Penetration Testing. **Exam tip / trap:** “Penetration testing without prior approval” → “certain / permitted services only”. Do not choose “all services” or “never”.

Question 15

Security groups are associated with which of the following?

A. Subnets
B. Elastic Network Interfaces (ENIs) of resources
C. VPC route tables
D. AWS accounts only

Click to reveal answer

**Correct Answer: B** **Explanation:** Security groups operate at the resource level and are attached to the Elastic Network Interface (ENI) of instances (EC2, RDS, etc.). Network ACLs are associated with subnets. **Exam tip / trap:** “Resource level” or “ENI” → security groups. “Subnet” → NACL.

Question 16

Which of the following statements about security groups are correct? (Choose TWO.)

A. Security groups are stateless.
B. Security groups support allow rules only.
C. Security groups can reference other security groups as a source.
D. Security groups can explicitly deny traffic.
E. Security groups evaluate rules in number order.

Click to reveal answer

**Correct Answer: B, C** **Explanation:** - Security groups have only allow rules (implicit deny). - They can use other security group IDs as sources/destinations. - They are stateful and do not use numbered ordered evaluation like NACLs. **Exam tip / trap:** Remember: Security groups = stateful, allow-only, can reference SG IDs. NACLs = stateless, allow + deny, numbered rules.

Question 17

A Cloud Practitioner wants to stay updated on the latest AWS security announcements, new features, and best-practice articles. Which resource is most appropriate?

A. AWS Knowledge Center
B. AWS Security Blog
C. AWS Artifact
D. AWS Marketplace

Click to reveal answer

**Correct Answer: B** **Explanation:** The AWS Security Blog publishes regular articles on new security features, best practices, threat intelligence, and customer stories. **Exam tip / trap:** “Latest news / announcements / articles” → Security Blog. Knowledge Center = FAQs; Artifact = compliance reports.

Question 18

Which AWS service or feature can identify security issues such as overly permissive security groups, unrestricted access to S3 buckets, or root account usage?

A. AWS WAF
B. AWS Trusted Advisor
C. AWS Shield
D. Amazon VPC

Click to reveal answer

**Correct Answer: B** **Explanation:** AWS Trusted Advisor includes security checks that flag common misconfigurations (open ports, public S3 buckets, MFA on root, etc.). **Exam tip / trap:** “Identify security issues / recommendations / best practices” → Trusted Advisor is the classic answer at CLF level.

Question 19

A company needs to protect its web applications from common web exploits and also wants centralized management of those protection rules across dozens of accounts. Which combination of services should they use? (Choose TWO.)

A. AWS WAF
B. AWS Firewall Manager
C. Amazon GuardDuty
D. AWS Shield Standard only
E. Network ACLs

Click to reveal answer

**Correct Answer: A, B** **Explanation:** AWS WAF provides the web exploit protection (SQL injection, XSS, etc.). AWS Firewall Manager enables centralized deployment and management of WAF rules across accounts. **Exam tip / trap:** “Web exploits” → WAF; “centralized / multi-account management” → Firewall Manager. These two are frequently paired.

Question 20

Which of the following are recommended places to find official AWS security best practices, service documentation, and deeper technical guidance? (Choose TWO.)

A. AWS Documentation
B. AWS Whitepapers and Guides
C. Random third-party blogs only
D. EC2 user data scripts
E. AWS Marketplace product reviews only

Click to reveal answer

**Correct Answer: A, B** **Explanation:** Official sources include AWS Documentation (service guides, best practices), AWS Whitepapers (security pillar of Well-Architected, security overviews, etc.), AWS Security Blog, Knowledge Center, and Security Center. **Exam tip / trap:** Always prefer official AWS sources (docs, whitepapers, blogs, Knowledge Center). The exam emphasizes knowing where to find authoritative information.

Study Reminder for Task 2.4

Master the security groups vs NACL comparison (stateful/stateless, allow-only vs allow+deny, ENI vs subnet).
Know high-level purpose of WAF, Shield, Firewall Manager, GuardDuty, Inspector, Trusted Advisor.
Remember AWS Marketplace for third-party tools.
Know the information sources: Knowledge Center, Security Center, Security Blog, documentation, whitepapers.

Good luck with your CLF-C02 exam!