CLF-C02 Security and Compliance practice questions

Security and Compliance is 30% of the AWS Certified Cloud Practitioner (CLF-C02) exam, the second-heaviest of its 4 domains: roughly 15 of the 50 scored questions, and every 10% of accuracy here moves your scaled score about 30 points. Below are 7 free questions from this domain only, each with the answer explained and why every wrong option misses. Last updated 2026-07-19.

Every question is verified against official AWS documentation, linked below each answer.

  1. Question 1Security and Compliance

    A compliance officer wants to track how an S3 bucket's configuration, such as its public access settings, has changed over time, and be alerted automatically if a resource drifts away from an approved configuration baseline. Which service is designed for this?

    Reveal answer & explanation

    Answer: D. AWS Config

    AWS Config continuously records the configuration state of AWS resources over time and can evaluate them against defined rules, alerting when a resource such as an S3 bucket drifts from an approved baseline like 'block all public access' - exactly the described requirement.

    Go deeper: Why can't CloudTrail alone show you how a resource's configuration looked last month? What role do Config rules play in catching a resource that's drifted from its baseline?

    Source: official AWS documentation · verified 2026-07-19

  2. Question 2Security and Compliance

    A prospective enterprise customer's legal team requests AWS's SOC 2 report and ISO 27001 certification before agreeing to sign a contract. Where can the company download these AWS compliance reports on demand?

    Reveal answer & explanation

    Answer: A. AWS Artifact

    AWS Artifact is the self-service portal where customers can download AWS's compliance reports and certifications, such as SOC 1/2/3 reports and ISO certifications, as well as agreements like the Business Associate Addendum, on demand.

    Go deeper: Why wouldn't Trusted Advisor be the right place to find a SOC 2 report? What kinds of documents does AWS Artifact make available on demand?

    Source: official AWS documentation · verified 2026-07-19

  3. Question 3Security and Compliance

    A company wants to add an extra layer of protection so that even if an IAM user's password is stolen, an attacker still cannot sign in without a second piece of proof, such as a rotating code from a mobile authenticator app or a hardware security key. Which AWS feature should they enable?

    Reveal answer & explanation

    Answer: D. Multi-factor authentication (MFA)

    Multi-factor authentication requires a second, independent factor - something the user has, like a virtual MFA device, hardware token, or authenticator app code - in addition to the password, so a stolen password alone is not enough to sign in.

    Go deeper: Why doesn't a longer password alone solve the 'stolen password' problem? What does 'something you have' add to sign-in security that a password alone doesn't?

    Source: official AWS documentation · verified 2026-07-19

  4. Question 4Security and Compliance

    A company's public-facing web application has recently been targeted by SQL injection and cross-site scripting (XSS) attempts. Which AWS service lets them create rules to filter and monitor HTTP/HTTPS requests before they reach the application?

    Reveal answer & explanation

    Answer: B. AWS WAF (Web Application Firewall)

    AWS WAF operates at the application layer, letting customers write and apply rules that inspect HTTP/HTTPS requests and block common web exploits such as SQL injection and cross-site scripting before they reach the application.

    Go deeper: Why is Shield the wrong tool for filtering malicious HTTP requests? What layer of the application stack does WAF inspect that a DDoS service doesn't?

    Source: official AWS documentation · verified 2026-07-19

  5. Question 5Security and Compliance

    A startup's compliance team asks who is responsible for the physical security of the data centers, and for maintaining the underlying host hardware and hypervisor, that run their EC2 instances. Under the AWS shared responsibility model, which party owns this responsibility?

    Reveal answer & explanation

    Answer: A. AWS is responsible for security 'of' the cloud, which includes physical data center security, the host hardware, and the hypervisor layer.

    Under the shared responsibility model, AWS is responsible for security 'of' the cloud: the physical facilities, hardware, networking infrastructure, and the virtualization (hypervisor) layer that hosts customer instances.

    Go deeper: Why can't a customer audit AWS's data centers directly, even if their compliance team wants to? What does 'security of the cloud' cover that 'security in the cloud' doesn't?

    Source: official AWS documentation · verified 2026-07-19

  6. Question 6Security and Compliance

    A company launches Amazon EC2 instances to host a new web application. Under the AWS shared responsibility model, which of the following tasks is the customer's responsibility rather than AWS's?

    Reveal answer & explanation

    Answer: B. Patching the guest operating system, configuring security group rules, and choosing how to encrypt application data.

    For EC2, an unmanaged (infrastructure-as-a-service) offering, the customer is responsible for security 'in' the cloud: patching the guest operating system, configuring network controls like security groups, managing identity and access, and deciding how to encrypt their data.

    Go deeper: Which of these four tasks would still be the customer's job even on a fully managed database service? Why is patching the hypervisor never something a customer can do, even if they wanted to?

    Source: official AWS documentation · verified 2026-07-19

  7. Question 7Security and Compliance

    A company currently runs a self-managed database on EC2 instances, where they patch the OS and the database engine themselves. They are evaluating a move to Amazon RDS instead. Under the shared responsibility model, what changes when they make this move?

    Reveal answer & explanation

    Answer: C. AWS takes on responsibility for patching the underlying operating system and database engine software, shifting more of the operational burden to AWS compared with self-managed EC2.

    Moving from self-managed EC2 to a managed service like RDS shifts the shared responsibility line: AWS now handles OS patching and database engine maintenance, tasks the customer previously owned on EC2. This is the core benefit of managed services.

    Go deeper: What operational burden does AWS take on when a team moves from self-managed EC2 to RDS? What does the customer still have to manage even after switching to a managed database service?

    Source: official AWS documentation · verified 2026-07-19

More CLF-C02 practice