CLF-C02 practice questions: Security and Compliance

Answer: C. Task Statement 2.2 names AWS Artifact as the place to find AWS compliance information. The AWS Artifact user guide states that it 'provides on-demand downloads of AWS security and compliance documents. For example, reports on compliance with International Organization for Standardization (ISO) standards and Payment Card Industry (PCI) Security Standards, and System and Organization Controls (SOC) reports,' and that you can 'submit AWS Artifact documents to your auditors or regulators as audit artifacts.' It adds that 'AWS provides AWS Artifact documents and agreements to you free of charge.' Every distractor reports on the customer's own environment rather than on AWS. Source: AWS CLF-C02 Exam Guide - Domain 2: Security and Compliance

Answer: C. Task Statement 2.2 asks candidates to identify encryption options. The AWS KMS developer guide states that it 'is an AWS managed service that makes it easy for you to create and control the keys used to encrypt and sign your data,' and that 'you can create and manage key policies in AWS KMS, ensuring that only trusted users have access to KMS keys.' The AWS CloudHSM user guide draws the boundary itself: 'If you want a managed service for creating and controlling your encryption keys but you don't want or need to operate your own HSMs, consider using AWS Key Management Service.' AWS Certificate Manager covers the certificates that protect data in transit, and Parameter Store encrypts its secure strings with keys that are managed elsewhere. Source: AWS CLF-C02 Exam Guide - Domain 2: Security and Compliance

Answer: B. Task Statement 2.2 covers where to capture and locate security-related logs. The AWS CloudTrail user guide states that 'Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail' and that 'Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs,' and that you can 'identify who or what took which action, what resources were acted upon, when the event occurred.' AWS Config is the deliberate near miss, since its record is of resource state rather than of the identity behind a call. Source: AWS CLF-C02 Exam Guide - Domain 2: Security and Compliance

Answer: C. Task Statement 2.4 covers the security capabilities AWS provides. The AWS WAF developer guide's AWS Firewall Manager chapter states that 'AWS Firewall Manager simplifies your administration and maintenance tasks across multiple accounts', that you set up the protections once 'and the service automatically applies them across your accounts and resources, even as you add new accounts and resources', and that it is the right choice 'if you frequently add new resources that you want to protect'. The same chapter keeps AWS WAF as the service that defines and holds the web ACL itself. Source: AWS CLF-C02 Exam Guide - Domain 2: Security and Compliance

Answer: C. Task Statement 2.4 asks candidates to identify where AWS security information is available. The AWS Security Bulletins page states: 'We investigate all reported security vulnerabilities affecting Amazon and AWS services, software, and products', and it lists each bulletin by CVE and affected AWS service or software, separating bulletins that require attention from informational ones. The AWS Security Blog publishes posts on AWS security features, compliance updates and hands-on guidance; its monthly digest posts invite readers to 'Read all about the latest AWS security features, compliance updates, and hands-on resources'. The Amazon Inspector user guide states that Inspector 'is a vulnerability management service that automatically discovers workloads and continually scans them for software vulnerabilities and unintended network exposure', for the customer's EC2 instances, ECR container images and Lambda functions. Source: https://aws.amazon.com/security/security-bulletins/ Source: https://aws.amazon.com/security/security-bulletins/