Practice Test Geeks(CLF-C02) AWS Certified Cloud Practitioner Practice Test
← All CLF-C02 Flashcard Decks

Security & Compliance in the Cloud Flashcards

7 cards from real CLF-C02 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Security & Compliance in the Cloud flashcards as text

  1. Which AWS service is specifically designed to protect against large-scale Distributed Denial of Service (DDoS) attacks and is automatically available to all AWS customers at no extra cost?

    Answer: AWS Shield Standard

    AWS Shield Standard provides automatic protection against common and most frequently occurring DDoS attacks at no additional cost for all AWS customers.

  2. Which AWS service stores and rotates database credentials, API keys, and other secrets, eliminating the need to hardcode them in application code?

    Answer: AWS Secrets Manager

    AWS Secrets Manager securely stores, rotates, and manages access to secrets like database credentials and API keys throughout their lifecycle.

  3. In the Shared Responsibility Model, which of the following is AWS responsible for?

    Answer: Maintaining physical data center security

    AWS is responsible for the physical security of its data centers as part of managing the security 'of' the cloud.

  4. Which type of IAM policy is attached directly to an AWS resource, such as an S3 bucket, to control who can access it?

    Answer: Resource-based policy

    Resource-based policies are attached directly to resources like S3 buckets and define who (which principals) can perform actions on that resource.

  5. A company needs to meet PCI DSS compliance for processing credit card payments on AWS. Which AWS service helps them generate evidence and streamline compliance audits?

    Answer: AWS Audit Manager

    AWS Audit Manager continuously collects evidence and maps it to compliance frameworks like PCI DSS to simplify audit preparation.

  6. Which AWS IAM best practice helps protect the root account from unauthorized access?

    Answer: Enable Multi-Factor Authentication (MFA) on the root account

    Enabling MFA on the root account is a critical best practice that adds an additional layer of protection against unauthorized access.

  7. Which AWS service provides managed DDoS protection with 24/7 access to the AWS DDoS Response Team (DRT) and cost protection?

    Answer: AWS Shield Advanced

    AWS Shield Advanced is the paid tier that provides enhanced DDoS protection, access to the DRT, and financial protections against DDoS-related scaling costs.