AWS CLF-C02 Identity and Access
Management Questions 2026–2027 |
Cloud Practitioner Security Certification
Prep with Answers
1. A company wants to provide temporary AWS access to an application
running on Amazon EC2 without storing long-term AWS access keys on the
instance. Which solution is MOST appropriate?
A. Store an IAM user's access key in an encrypted file on the EC2 instance
B. Create an IAM user and rotate its access keys frequently
C. Attach an IAM role to the EC2 instance
D. Store credentials in the EC2 instance's user data
Answer: C. Attach an IAM role to the EC2 instance
Rationale: IAM roles provide temporary credentials that AWS automatically
manages. This avoids embedding long-term credentials on EC2 instances and
follows the principle of least privilege.
2. Which AWS service provides centralized identity management and
workforce access to multiple AWS accounts and applications?
,A. Amazon Cognito
B. AWS Key Management Service (AWS KMS)
C. AWS IAM Identity Center
D. AWS Secrets Manager
Answer: C. AWS IAM Identity Center
Rationale: AWS IAM Identity Center provides centralized workforce identity and
access management across AWS accounts and supported applications.
3. A developer needs permissions to read objects from a specific Amazon S3
bucket but must not be able to delete or modify objects. Which IAM
principle is being applied?
A. Defense in depth
B. Fault tolerance
C. Least privilege
D. High availability
Answer: C. Least privilege
Rationale: Least privilege means granting only the permissions required to
perform a task. Read-only access to the required S3 resources minimizes
unnecessary privileges.
4. Which AWS security service continuously monitors AWS accounts for
suspicious activity and malicious behavior?
A. AWS Shield
B. Amazon Inspector
C. Amazon GuardDuty
D. AWS Artifact
Answer: C. Amazon GuardDuty
Rationale: Amazon GuardDuty is a threat detection service that analyzes AWS
account, workload, and data activity to identify potentially malicious or
unauthorized behavior.
, 5. Which AWS service helps identify software vulnerabilities in Amazon EC2
workloads?
A. AWS WAF
B. Amazon Macie
C. Amazon Inspector
D. AWS Shield
Answer: C. Amazon Inspector
Rationale: Amazon Inspector automatically discovers and assesses
vulnerabilities and unintended network exposure in supported workloads,
including EC2 instances.
6. A company wants to protect a web application against common attacks
such as SQL injection and cross-site scripting. Which AWS service should it
use?
A. Amazon GuardDuty
B. AWS WAF
C. AWS Artifact
D. AWS CloudTrail
Answer: B. AWS WAF
Rationale: AWS WAF is a web application firewall designed to help protect
applications from common web exploits such as SQL injection and cross-site
scripting.
7. Which AWS service records API activity performed through the AWS
Management Console, AWS CLI, SDKs, and AWS APIs?
A. Amazon Inspector
B. AWS Security Hub
C. AWS CloudTrail
D. Amazon GuardDuty
Answer: C. AWS CloudTrail
, Rationale: AWS CloudTrail records AWS API activity and provides an audit trail
that can be used for governance, compliance, security investigations, and
operational troubleshooting.
8. Which credential type is generally recommended for an application running
on an AWS service such as Amazon EC2?
A. Root-user credentials
B. IAM user access keys
C. IAM role credentials
D. AWS account password
Answer: C. IAM role credentials
Rationale: IAM roles provide temporary credentials and eliminate the need to
distribute long-term access keys to applications running on AWS resources.
9. What is the MOST important reason to avoid using the AWS account root
user for everyday administrative tasks?
A. Root users cannot access AWS services
B. Root users have limited permissions
C. The root user has unrestricted access to the AWS account
D. Root users cannot enable MFA
Answer: C. The root user has unrestricted access to the AWS account
Rationale: The root user has extensive privileges that cannot be restricted
through IAM policies. AWS recommends securing it with MFA and avoiding
routine use.
10.Which control provides an additional authentication factor beyond a
username and password?
A. IAM policy
B. Security group
C. Multi-factor authentication (MFA)
D. Network ACL
Management Questions 2026–2027 |
Cloud Practitioner Security Certification
Prep with Answers
1. A company wants to provide temporary AWS access to an application
running on Amazon EC2 without storing long-term AWS access keys on the
instance. Which solution is MOST appropriate?
A. Store an IAM user's access key in an encrypted file on the EC2 instance
B. Create an IAM user and rotate its access keys frequently
C. Attach an IAM role to the EC2 instance
D. Store credentials in the EC2 instance's user data
Answer: C. Attach an IAM role to the EC2 instance
Rationale: IAM roles provide temporary credentials that AWS automatically
manages. This avoids embedding long-term credentials on EC2 instances and
follows the principle of least privilege.
2. Which AWS service provides centralized identity management and
workforce access to multiple AWS accounts and applications?
,A. Amazon Cognito
B. AWS Key Management Service (AWS KMS)
C. AWS IAM Identity Center
D. AWS Secrets Manager
Answer: C. AWS IAM Identity Center
Rationale: AWS IAM Identity Center provides centralized workforce identity and
access management across AWS accounts and supported applications.
3. A developer needs permissions to read objects from a specific Amazon S3
bucket but must not be able to delete or modify objects. Which IAM
principle is being applied?
A. Defense in depth
B. Fault tolerance
C. Least privilege
D. High availability
Answer: C. Least privilege
Rationale: Least privilege means granting only the permissions required to
perform a task. Read-only access to the required S3 resources minimizes
unnecessary privileges.
4. Which AWS security service continuously monitors AWS accounts for
suspicious activity and malicious behavior?
A. AWS Shield
B. Amazon Inspector
C. Amazon GuardDuty
D. AWS Artifact
Answer: C. Amazon GuardDuty
Rationale: Amazon GuardDuty is a threat detection service that analyzes AWS
account, workload, and data activity to identify potentially malicious or
unauthorized behavior.
, 5. Which AWS service helps identify software vulnerabilities in Amazon EC2
workloads?
A. AWS WAF
B. Amazon Macie
C. Amazon Inspector
D. AWS Shield
Answer: C. Amazon Inspector
Rationale: Amazon Inspector automatically discovers and assesses
vulnerabilities and unintended network exposure in supported workloads,
including EC2 instances.
6. A company wants to protect a web application against common attacks
such as SQL injection and cross-site scripting. Which AWS service should it
use?
A. Amazon GuardDuty
B. AWS WAF
C. AWS Artifact
D. AWS CloudTrail
Answer: B. AWS WAF
Rationale: AWS WAF is a web application firewall designed to help protect
applications from common web exploits such as SQL injection and cross-site
scripting.
7. Which AWS service records API activity performed through the AWS
Management Console, AWS CLI, SDKs, and AWS APIs?
A. Amazon Inspector
B. AWS Security Hub
C. AWS CloudTrail
D. Amazon GuardDuty
Answer: C. AWS CloudTrail
, Rationale: AWS CloudTrail records AWS API activity and provides an audit trail
that can be used for governance, compliance, security investigations, and
operational troubleshooting.
8. Which credential type is generally recommended for an application running
on an AWS service such as Amazon EC2?
A. Root-user credentials
B. IAM user access keys
C. IAM role credentials
D. AWS account password
Answer: C. IAM role credentials
Rationale: IAM roles provide temporary credentials and eliminate the need to
distribute long-term access keys to applications running on AWS resources.
9. What is the MOST important reason to avoid using the AWS account root
user for everyday administrative tasks?
A. Root users cannot access AWS services
B. Root users have limited permissions
C. The root user has unrestricted access to the AWS account
D. Root users cannot enable MFA
Answer: C. The root user has unrestricted access to the AWS account
Rationale: The root user has extensive privileges that cannot be restricted
through IAM policies. AWS recommends securing it with MFA and avoiding
routine use.
10.Which control provides an additional authentication factor beyond a
username and password?
A. IAM policy
B. Security group
C. Multi-factor authentication (MFA)
D. Network ACL
