AWS CLF-C02: Security and Compliance Practice Questions

Correct: 'AWS WAF' (Web Application Firewall) is designed to filter HTTP/HTTPS web traffic at the application layer (Layer 7). It provides managed rule groups specifically for SQL injection, XSS, and other OWASP Top 10 vulnerabilities. | Wrong: 'AWS Shield Advanced' protects against volumetric DDoS attacks at Layers 3 and 4; it does not inspect application-layer traffic for SQL injection or XSS patterns. | Wrong: 'Amazon GuardDuty' analyzes VPC Flow Logs, DNS logs, and CloudTrail for threat intelligence; it does not intercept or filter web traffic. | Wrong: 'VPC Network ACLs' operate at Layer 3/4 and can only filter by IP address, protocol, and port — they cannot inspect HTTP request payloads for injection attacks.

AWS Secrets Manager is purpose-built for storing, retrieving, and automatically rotating secrets such as database credentials, OAuth tokens, and API keys. It integrates natively with RDS, Redshift, and DocumentDB for zero-downtime rotation and logs all access via CloudTrail. Systems Manager Parameter Store (Standard tier) can store secrets as SecureString parameters but does not provide built-in automatic rotation—that capability requires custom Lambda functions. AWS KMS rotates the underlying Customer Master Key material annually but does not store or rotate application-level secrets. Amazon S3 with encryption is suitable for object storage, not secrets management with automatic rotation.

IAM roles issue temporary security credentials (via AWS STS) that automatically expire, making them ideal for granting temporary access without long-term credentials. Creating an IAM user with an access key generates long-term credentials, which violates the policy even if deleted afterward. Sharing root credentials is a critical security anti-pattern and violates AWS best practices. Adding the user to an IAM group still requires creating a permanent IAM user with long-term credentials.

Correct: 'Security groups for stateful instance-level control; Network ACLs for stateless subnet-level control' — security groups are stateful (return traffic is automatically allowed) and applied at the instance/ENI level. Network ACLs are stateless (return traffic must be explicitly allowed) and applied at the subnet level, providing an additional defense layer. | Wrong: The second option reverses the properties — Network ACLs are stateless and apply to subnets, not instances; security groups are stateful and apply to instances, not subnets. | Wrong: AWS WAF and AWS Shield are perimeter services for web traffic and DDoS protection respectively; they are not replacements for VPC-level security controls. | Wrong: VPC Flow Logs capture network traffic metadata for analysis but do not control or filter traffic. Route tables handle routing, not security filtering.

SCPs attached to the root of an AWS Organization apply to every member account automatically, including accounts added in the future, and can deny actions such as creating unencrypted S3 buckets. IAM permission boundaries limit maximum permissions for individual principals but must be applied manually to each user/role and do not enforce organization-wide guardrails. AWS Config can detect and flag non-compliant buckets but is a detective control, not a preventive one—it cannot stop an account from creating an unencrypted bucket. IAM policies cannot be shared across accounts via RAM and have no authority over other accounts' principals.