A solutions architect is designing a new application for a financial services customer. The security requirements are: (1) all data must be encrypted at rest, (2) access to the management console must require multi-factor authentication (MFA), and (3) the application must be able to assume a role to access other AWS services without storing long-term credentials. The architect is reviewing the AWS Well-Architected Framework Security Pillar. Which combination of practices aligns with the security pillar's best practices?

Create long-term IAM access keys for the application, enforce MFA only on the root account, and use S3 server-side encryption

Enable IAM roles for the application, enforce MFA on the root account and IAM users, and use AWS KMS for data encryption

Use a single IAM user for all developers, disable MFA to reduce friction, and rely on network ACLs for data protection

Store database credentials in the application code, enable MFA for the root account, and use AWS Certificate Manager for data encryption

A company has grown to use 50 AWS accounts. The central governance team is struggling to maintain visibility and control. They need to: (1) centrally apply a baseline security policy to all accounts, (2) have a single view of security findings across all accounts, and (3) maintain an audit trail of all API activity. Which combination of AWS services should they use to meet all three requirements?

AWS Config, Amazon GuardDuty, and AWS Trusted Advisor

AWS Organizations with SCPs, AWS Security Hub, and AWS CloudTrail

AWS Organizations with IAM policies, AWS Audit Manager, and AWS Artifact

AWS Control Tower, Amazon Inspector, and AWS Systems Manager

AWSCertified Cloud Practitioner

Domain 2Objective 2

Task Statement 2.2: Understand AWS Cloud Security, Governance, and Compliance Concepts. CLF-C02 Practice Questions (Page 1)

Part of the Security and Compliance domain, which makes up ~24% of our current practice bank. AWS does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

22concepts

22 Concepts in This Objective

AWS Shared Responsibility Model
AWS Compliance Programs and Certifications
AWS Artifact
AWS Config
AWS CloudTrail
AWS Audit Manager
AWS Security Hub
AWS GuardDuty
AWS Identity and Access Management (IAM)
AWS Organizations and Service Control Policies (SCPs)
AWS Key Management Service (KMS)
AWS CloudHSM
AWS WAF
AWS Shield
AWS Inspector
AWS Macie
AWS Certificate Manager
AWS Secrets Manager
AWS Systems Manager
AWS Trusted Advisor
AWS Well-Architected Framework Security Pillar
AWS Cloud Compliance and Governance Best Practices

Questions 1–5

1foundation · easy
Which AWS compliance program is specifically designed for organizations that handle credit card data?
Select an answer first
2expert · hard
A solutions architect is designing a new application for a financial services customer. The security requirements are: (1) all data must be encrypted at rest, (2) access to the management console must require multi-factor authentication (MFA), and (3) the application must be able to assume a role to access other AWS services without storing long-term credentials. The architect is reviewing the AWS Well-Architected Framework Security Pillar. Which combination of practices aligns with the security pillar's best practices?
Select an answer first
3application · medium
A developer needs temporary access to an S3 bucket to upload build artifacts. The company wants to avoid creating long-term IAM users for this purpose and instead wants to grant the developer's application the necessary permissions dynamically. Which IAM feature should be used to grant these temporary permissions?
Select an answer first
4expert · hard
A company has grown to use 50 AWS accounts. The central governance team is struggling to maintain visibility and control. They need to: (1) centrally apply a baseline security policy to all accounts, (2) have a single view of security findings across all accounts, and (3) maintain an audit trail of all API activity. Which combination of AWS services should they use to meet all three requirements?
Select an answer first
5foundation · easy
Which AWS service provides protection against Distributed Denial of Service (DDoS) attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLF-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “CLF-C02” is a trademark of its owner, used for identification only.

Task Statement 2.2: Understand AWS Cloud Security, Governance, and Compliance Concepts. CLF-C02 Practice Questions (Page 1)

Questions 1–5

Which AWS compliance program is specifically designed for organizations that handle credit card data?

Which AWS service provides protection against Distributed Denial of Service (DDoS) attacks?

Keep studying — Security and Compliance