A company uses AWS Organizations and wants to ensure that all accounts comply with a policy that requires EC2 instances to have a specific tag. They want to automatically detect non-compliant instances and receive a notification. Which solution should they implement?

Use AWS Security Hub to check for the tag, and configure an SNS topic to send notifications.

Use AWS CloudTrail to check for the tag, and configure an SNS topic to send notifications.

Use an SCP that requires the tag on all EC2 instances, and use AWS Config to send notifications.

Use AWS Config with a managed rule that checks for the required tag, and configure an SNS topic to send notifications when instances are non-compliant.

A company stores sensitive customer data in Amazon S3. To meet compliance requirements, they must encrypt the data at rest and control the encryption keys. They also need to automatically rotate the keys annually. Which AWS service should they use to manage the encryption keys?

AWS Key Management Service (KMS)

A company wants to continuously monitor their AWS environment for potential security threats, including suspicious API calls and vulnerable software on EC2 instances. They also want to have a centralized view of all security findings. Which combination of AWS services should they use?

Amazon GuardDuty, AWS Config, and AWS CloudTrail

Amazon GuardDuty, Amazon Inspector, and AWS Security Hub

AWS CloudTrail, AWS Config, and AWS Security Hub

Amazon Inspector, AWS CloudTrail, and AWS Config

AWSCertified Cloud Practitioner

Domain 2Objective 4

Task Statement 2.4: Identify Components and Resources for Security. CLF-C02 Practice Questions (Page 1)

Part of the Security and Compliance domain, which makes up ~24% of our current practice bank. AWS does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

14concepts

14 Concepts in This Objective

AWS Shared Responsibility Model
AWS Identity and Access Management (IAM)
AWS Organizations and Service Control Policies (SCPs)
AWS Key Management Service (KMS)
AWS CloudTrail
AWS Config
AWS Shield and AWS WAF
AWS Inspector and GuardDuty
AWS Artifact
AWS Security Hub
AWS Secrets Manager
AWS Certificate Manager (ACM)
AWS Network Security Services
AWS Compliance Programs and Reports

Questions 1–5

1foundation · easy
Which AWS compliance program provides reports that demonstrate how AWS meets the requirements of the Payment Card Industry Data Security Standard (PCI DSS)?
Select an answer first
2expert · medium
A company uses AWS Organizations and wants to ensure that all accounts comply with a policy that requires EC2 instances to have a specific tag. They want to automatically detect non-compliant instances and receive a notification. Which solution should they implement?
Select an answer first
3application · medium
A company stores sensitive customer data in Amazon S3. To meet compliance requirements, they must encrypt the data at rest and control the encryption keys. They also need to automatically rotate the keys annually. Which AWS service should they use to manage the encryption keys?
Select an answer first
4expert · medium
A company wants to continuously monitor their AWS environment for potential security threats, including suspicious API calls and vulnerable software on EC2 instances. They also want to have a centralized view of all security findings. Which combination of AWS services should they use?
Select an answer first
5foundation · easy
Which AWS service records API activity in your account for auditing and compliance purposes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLF-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “CLF-C02” is a trademark of its owner, used for identification only.

Task Statement 2.4: Identify Components and Resources for Security. CLF-C02 Practice Questions (Page 1)

Questions 1–5

Which AWS compliance program provides reports that demonstrate how AWS meets the requirements of the Payment Card Industry Data Security Standard (PCI DSS)?

A company uses AWS Organizations and wants to ensure that all accounts comply with a policy that requires EC2 instances to have a specific tag. They want to automatically detect non-compliant instances and receive a notification. Which solution should they implement?

A company stores sensitive customer data in Amazon S3. To meet compliance requirements, they must encrypt the data at rest and control the encryption keys. They also need to automatically rotate the keys annually. Which AWS service should they use to manage the encryption keys?

A company wants to continuously monitor their AWS environment for potential security threats, including suspicious API calls and vulnerable software on EC2 instances. They also want to have a centralized view of all security findings. Which combination of AWS services should they use?

Which AWS service records API activity in your account for auditing and compliance purposes?

Keep studying — Security and Compliance