___________________________________________________________________
AWS CLF-C02 Security and Compliance
Exam Questions 2026–2027 | Cloud
Practitioner Certification Prep with
Answers & Explanations
1. A company wants to ensure that its AWS account root user is protected
against unauthorized access. Which security control provides the strongest
protection?
A. Create multiple root users
B. Enable multi-factor authentication (MFA) on the root user
C. Store the root credentials in an Amazon S3 bucket
D. Create an IAM group for the root user
Answer: Enable multi-factor authentication (MFA) on the root user
Rationale: MFA adds an additional authentication factor to the highly privileged
root account. AWS recommends enabling MFA on the root user and avoiding
routine use of root credentials.
2. Which AWS service provides centralized identity management and supports
workforce access to multiple AWS accounts and applications?
,A. AWS IAM
B. AWS IAM Identity Center
C. Amazon GuardDuty
D. AWS CloudTrail
Answer: AWS IAM Identity Center
Rationale: IAM Identity Center provides centralized workforce identity and
access management, including single sign-on across AWS accounts and
supported applications.
3. A company needs to determine which IAM user or role made a specific API
call in its AWS environment. Which service should be used?
A. Amazon Inspector
B. AWS CloudTrail
C. Amazon Macie
D. AWS Shield
Answer: AWS CloudTrail
Rationale: CloudTrail records AWS API activity and can help identify who
performed an action, when it occurred, and from where the request originated.
4. Which AWS security principle recommends granting only the permissions
required to perform a specific task?
A. Defense in depth
B. Least privilege
C. Fault tolerance
D. Elasticity
Answer: Least privilege
Rationale: Least privilege limits permissions to only what is necessary, reducing
the potential impact of compromised credentials or accidental actions.
, 5. A company wants to detect potentially malicious activity such as unusual
API behavior, compromised credentials, or communication with known
malicious IP addresses. Which AWS service is designed for this purpose?
A. Amazon GuardDuty
B. AWS Artifact
C. AWS Config
D. AWS Audit Manager
Answer: Amazon GuardDuty
Rationale: Amazon GuardDuty is a managed threat detection service that
continuously analyzes relevant AWS data sources for suspicious or malicious
activity.
6. Which AWS service helps identify software vulnerabilities and unintended
network exposure in Amazon EC2 workloads?
A. Amazon Inspector
B. Amazon Macie
C. AWS Shield
D. AWS Security Hub
Answer: Amazon Inspector
Rationale: Amazon Inspector helps identify software vulnerabilities and
unintended network exposure for supported AWS workloads.
7. A company needs to discover and protect sensitive data such as personally
identifiable information stored in Amazon S3. Which service is most
appropriate?
A. Amazon Macie
B. Amazon GuardDuty
C. AWS WAF
D. AWS Shield
Answer: Amazon Macie
, Rationale: Amazon Macie uses machine learning and pattern matching to
discover and help protect sensitive data in Amazon S3.
8. Which AWS service provides a centralized view of security findings from
multiple AWS services and supported partner products?
A. AWS Security Hub
B. AWS CloudTrail
C. AWS Artifact
D. IAM Identity Center
Answer: AWS Security Hub
Rationale: AWS Security Hub aggregates and correlates security findings from
multiple sources, helping organizations centrally monitor their security posture.
9. A company wants to protect a web application against common exploits
such as SQL injection and cross-site scripting. Which service should it
consider?
A. AWS WAF
B. AWS Shield
C. Amazon GuardDuty
D. Amazon Inspector
Answer: AWS WAF
Rationale: AWS WAF is a web application firewall that can help protect
applications against common web exploits through configurable rules.
10.Which AWS service primarily provides protection against distributed denial-
of-service attacks?
A. AWS Shield
B. AWS WAF
C. Amazon Macie
D. AWS Config
AWS CLF-C02 Security and Compliance
Exam Questions 2026–2027 | Cloud
Practitioner Certification Prep with
Answers & Explanations
1. A company wants to ensure that its AWS account root user is protected
against unauthorized access. Which security control provides the strongest
protection?
A. Create multiple root users
B. Enable multi-factor authentication (MFA) on the root user
C. Store the root credentials in an Amazon S3 bucket
D. Create an IAM group for the root user
Answer: Enable multi-factor authentication (MFA) on the root user
Rationale: MFA adds an additional authentication factor to the highly privileged
root account. AWS recommends enabling MFA on the root user and avoiding
routine use of root credentials.
2. Which AWS service provides centralized identity management and supports
workforce access to multiple AWS accounts and applications?
,A. AWS IAM
B. AWS IAM Identity Center
C. Amazon GuardDuty
D. AWS CloudTrail
Answer: AWS IAM Identity Center
Rationale: IAM Identity Center provides centralized workforce identity and
access management, including single sign-on across AWS accounts and
supported applications.
3. A company needs to determine which IAM user or role made a specific API
call in its AWS environment. Which service should be used?
A. Amazon Inspector
B. AWS CloudTrail
C. Amazon Macie
D. AWS Shield
Answer: AWS CloudTrail
Rationale: CloudTrail records AWS API activity and can help identify who
performed an action, when it occurred, and from where the request originated.
4. Which AWS security principle recommends granting only the permissions
required to perform a specific task?
A. Defense in depth
B. Least privilege
C. Fault tolerance
D. Elasticity
Answer: Least privilege
Rationale: Least privilege limits permissions to only what is necessary, reducing
the potential impact of compromised credentials or accidental actions.
, 5. A company wants to detect potentially malicious activity such as unusual
API behavior, compromised credentials, or communication with known
malicious IP addresses. Which AWS service is designed for this purpose?
A. Amazon GuardDuty
B. AWS Artifact
C. AWS Config
D. AWS Audit Manager
Answer: Amazon GuardDuty
Rationale: Amazon GuardDuty is a managed threat detection service that
continuously analyzes relevant AWS data sources for suspicious or malicious
activity.
6. Which AWS service helps identify software vulnerabilities and unintended
network exposure in Amazon EC2 workloads?
A. Amazon Inspector
B. Amazon Macie
C. AWS Shield
D. AWS Security Hub
Answer: Amazon Inspector
Rationale: Amazon Inspector helps identify software vulnerabilities and
unintended network exposure for supported AWS workloads.
7. A company needs to discover and protect sensitive data such as personally
identifiable information stored in Amazon S3. Which service is most
appropriate?
A. Amazon Macie
B. Amazon GuardDuty
C. AWS WAF
D. AWS Shield
Answer: Amazon Macie
, Rationale: Amazon Macie uses machine learning and pattern matching to
discover and help protect sensitive data in Amazon S3.
8. Which AWS service provides a centralized view of security findings from
multiple AWS services and supported partner products?
A. AWS Security Hub
B. AWS CloudTrail
C. AWS Artifact
D. IAM Identity Center
Answer: AWS Security Hub
Rationale: AWS Security Hub aggregates and correlates security findings from
multiple sources, helping organizations centrally monitor their security posture.
9. A company wants to protect a web application against common exploits
such as SQL injection and cross-site scripting. Which service should it
consider?
A. AWS WAF
B. AWS Shield
C. Amazon GuardDuty
D. Amazon Inspector
Answer: AWS WAF
Rationale: AWS WAF is a web application firewall that can help protect
applications against common web exploits through configurable rules.
10.Which AWS service primarily provides protection against distributed denial-
of-service attacks?
A. AWS Shield
B. AWS WAF
C. Amazon Macie
D. AWS Config
