Task Statement 2.4: Identify Components and Resources for Security. CLF-C02 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company has a VPC with a public subnet containing web servers and a private subnet containing database servers. They want to control traffic at the instance level, allowing only HTTP and HTTPS from the internet to the web servers, and only MySQL traffic from the web servers to the database servers. Which AWS service should they use for this?

   • ASecurity groups
   • BAWS Network Firewall
   • CNetwork ACLs
   • DAWS WAF
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an example of a security responsibility that remains with AWS, even for a customer-managed Amazon EC2 instance?

   • AProtecting the physical host that runs the instance
   • BConfiguring the instance's security group rules
   • CManaging the instance's operating system patches
   • DInstalling antivirus software on the instance
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a key feature of AWS Secrets Manager?

   • AIt scans your code for hardcoded secrets
   • BIt provides a firewall for your VPC
   • CIt can automatically rotate secrets for supported AWS services
   • DIt encrypts your entire Amazon S3 bucket
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has a compliance requirement that all S3 buckets must have versioning enabled. The security team wants to continuously monitor all accounts to identify any buckets that do not have versioning enabled and receive a notification when a non-compliant bucket is found. Which combination of AWS services should they use?

   • AAWS CloudTrail with a trail that logs S3 events, and Amazon CloudWatch Logs for monitoring.
   • BAWS Security Hub with a custom insight for S3 buckets, and Amazon EventBridge for notifications.
   • CAWS Config with a managed rule for S3 bucket versioning, and Amazon Simple Notification Service (SNS) for notifications.
   • DAmazon GuardDuty with a threat detection rule for S3, and AWS Lambda for remediation.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of an SSL/TLS certificate managed by AWS Certificate Manager?

   • ATo authenticate users to your application
   • BTo encrypt data in transit between clients and your application
   • CTo filter malicious web traffic
   • DTo encrypt data at rest in Amazon S3
   Reveal Solution Discussion Select an answer first