Welcome to Part 5 of our dedicated preparation series for the AWS Certified Cloud Practitioner (CLF-C02) certification. Protecting cloud workloads, securing sensitive data with encryption, and detecting modern cyber threats in real time are fundamental skills tested on the exam. While studying AWS whitepapers builds your baseline knowledge, solving realistic, scenario-based questions is the fastest way to truly master AWS Security, Encryption, and Threat Protection services, network firewalls, and cryptographic key management before your test day.
 |
| AWS Cloud Practitioner Free Practice Test - Security Encryption and Threat Protection |
In this aws cloud practitioner practice test free study guide (Part 5), we break down 20 high-yield exam questions (Questions 1 through 20) focused specifically on AWS Security, Encryption & Threat Protection. You will test your practical knowledge on essential cloud security services including Amazon Macie, Amazon GuardDuty, AWS WAF, AWS Shield (Standard vs. Advanced), AWS KMS, AWS CloudHSM, AWS Secrets Manager, AWS Certificate Manager (ACM), Amazon Inspector, Amazon Detective, AWS Security Hub, and the core differences between Security Groups and Network ACLs. Every question includes a clear, step-by-step breakdown explaining why the correct choice is right and why the other options fail to meet AWS best practices.
AWS Cloud Practitioner (CLF-C02) Practice Questions
Q1: Sensitive Data Discovery & Protection in Amazon S3
A company needs to automatically discover, classify, and protect sensitive data—such as personally identifiable information (PII)—stored in Amazon S3.
Which AWS service should the company use?
• Amazon Macie: Amazon Macie is a data security service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data (such as PII, credit card numbers, and credentials) stored in Amazon S3.
Why are the other options incorrect?
• Amazon Inspector: Amazon Inspector is an automated vulnerability management service that scans workloads (EC2 instances, container images, and Lambda functions) for software vulnerabilities.
• Amazon GuardDuty: Amazon GuardDuty is an intelligent threat detection service that continuously monitors AWS accounts and workloads for malicious activity.
• AWS Secrets Manager: AWS Secrets Manager is used to store, manage, and automatically rotate database credentials and API keys.
Q2: Layer 7 Attack & DDoS Protection (Select 2)
A company is designing a multi-layered security strategy for a web application hosted on Amazon EC2 behind an Application Load Balancer. The company needs to protect against Layer 7 application attacks (such as SQL injection) and provide automated DDoS mitigation.
Which TWO AWS services should the company use to meet these requirements? (Select TWO)
• AWS WAF: Protects web applications against Layer 7 exploits like SQL injection and Cross-Site Scripting (XSS).
• AWS Shield: Provides managed Distributed Denial of Service (DDoS) protection for AWS workloads.
Why are the other options incorrect?
• Amazon GuardDuty, Amazon Inspector, AWS Secrets Manager: GuardDuty is for log threat detection, Inspector scans for software vulnerabilities, and Secrets Manager stores credentials.
Q3: Stateful Instance-Level Firewall Security
Which AWS feature acts as a stateful virtual firewall to control inbound and outbound traffic at the Amazon EC2 instance level?
• Security Group: A Security group acts as a stateful virtual firewall for Amazon EC2 instances to control incoming and outgoing network traffic at the instance (network interface) level.
Why are the other options incorrect?
• Network Access Control List (network ACL): A Network Access Control List (network ACL) is a stateless firewall that operates at the subnet level, not at the individual instance level.
• Internet gateway: An Internet gateway is a VPC component that enables communication between resources in your VPC and the internet.
• AWS Direct Connect: AWS Direct Connect provides a dedicated physical connection from an on-premises data center to AWS.
Q4: Database Credentials & Automatic Rotation
A company wants to remove hardcoded database passwords from its application source code and enable automatic credential rotation on a regular schedule.
Which AWS service should the company use?
• AWS Secrets Manager: AWS Secrets Manager helps you store, manage, and retrieve database credentials, API keys, and other secrets. It provides native support for automatically rotating secrets on a schedule without updating application code.
Why are the other options incorrect?
• AWS Shield: AWS Shield is a managed DDoS protection service.
• Amazon Cognito: Amazon Cognito provides user sign-up, sign-in, and access control for web and mobile applications.
• AWS CloudTrail: AWS CloudTrail records API calls and account activities across AWS infrastructure for auditing.
Q5: Web Application Firewall & Layer 7 Protection
Which AWS service protects web applications from common Layer 7 web exploits, such as SQL injection (SQLi) and cross-site scripting (XSS), by inspecting incoming HTTP and HTTPS traffic?
• AWS WAF: AWS WAF is a web application firewall that helps protect web applications by filtering and monitoring HTTP/HTTPS traffic against common web exploits.
Why are the other options incorrect?
• Security groups: Security groups operate at Layer 3/4 by IP and port; they cannot inspect application-layer (Layer 7) HTTP/HTTPS request payloads.
• AWS Shield Standard: AWS Shield Standard provides automatic protection against Layer 3 and Layer 4 DDoS attacks.
• Amazon GuardDuty: Amazon GuardDuty is a threat detection service that monitors logs for suspicious activity; it does not act as an inline web firewall.
Q6: Dedicated Hardware Security Modules (HSMs)
A financial institution is required by compliance regulations to use dedicated, single-tenant hardware security modules (HSMs) where the customer retains exclusive control over cryptographic keys under FIPS 140-2 Level 3 standards.
Which AWS service fulfills this requirement?
• AWS CloudHSM: AWS CloudHSM provides dedicated, single-tenant Hardware Security Module (HSM) appliances inside your VPC where only the customer controls and manages the encryption keys.
Why are the other options incorrect?
• AWS Key Management Service (AWS KMS): AWS Key Management Service (AWS KMS) is a multi-tenant, fully managed encryption service where AWS manages the underlying HSM fleet.
• AWS Secrets Manager: AWS Secrets Manager is designed to store and rotate credentials and API keys.
• AWS Certificate Manager (ACM): AWS Certificate Manager (ACM) provisions and manages SSL/TLS certificates.
Q7: Centralized Cloud Security Posture Management
A security team manages multiple AWS accounts and needs a centralized service to aggregate security alerts from Amazon GuardDuty, Amazon Inspector, and Amazon Macie, while continuously checking compliance against industry benchmarks (such as CIS AWS Foundations).
Which AWS service should the team use?
• AWS Security Hub: AWS Security Hub is a cloud security posture management service that aggregates, organizes, and prioritizes security alerts and findings from multiple AWS services and accounts into a single dashboard.
Why are the other options incorrect?
• AWS Config: AWS Config tracks configuration changes of individual AWS resources over time against desired rules.
• Amazon CloudWatch: Amazon CloudWatch is an observability and monitoring service for operational metrics and logs.
• AWS Trusted Advisor: AWS Trusted Advisor provides broad recommendations across cost, performance, and security best practices.
Q8: Automated Vulnerability Management
Which AWS service automatically scans Amazon EC2 instances and container images for software vulnerabilities and unintended network exposure?
• Amazon Inspector: Amazon Inspector is an automated vulnerability management service that scans Amazon EC2 instances, container images in Amazon ECR, and AWS Lambda functions for software vulnerabilities (CVEs) and unintended network exposure.
Why are the other options incorrect?
• AWS Shield: AWS Shield is a managed DDoS protection service.
• Amazon GuardDuty: Amazon GuardDuty detects malicious activities and unauthorized behaviors from logs, rather than scanning installed software packages for CVEs.
• AWS Secrets Manager: AWS Secrets Manager is used to store and rotate credentials and API keys.
Q9: AWS Network & Data Security Evaluation (Yes/No)
Review the three statements below regarding AWS Network & Data Security. Determine whether each statement is Yes (True) or No (False):
1. Network ACLs evaluate inbound rules in numerical order, starting with the lowest numbered rule.
2. AWS KMS allows users to export plaintext root encryption key material outside of AWS hardware security modules.
3. AWS Artifact is used to configure real-time firewall rules and block malicious incoming IP addresses.
• Statement 1 is YES (True): Network ACLs process rules in numerical order starting with the lowest number; as soon as a rule matches traffic, it is applied immediately.
• Statement 2 is NO (False): AWS KMS uses FIPS-validated Hardware Security Modules designed never to export plaintext KMS root keys outside the security boundary.
• Statement 3 is NO (False): AWS Artifact is an audit and compliance document repository, not a network firewall.
Q10: Amazon S3 Resource Permissions & ACLs
A company needs to manage read and write access permissions directly on an Amazon S3 bucket to control access for specific AWS accounts and users.
Which feature can be used directly on the Amazon S3 bucket for this purpose?
• Access Control Lists (ACLs): Access Control Lists (ACLs) are resource-based access policies attached directly to Amazon S3 buckets or objects to grant read/write permissions to authorized accounts or predefined groups.
Why are the other options incorrect?
• Security groups: Security groups are VPC-based firewalls for compute instances and cannot be attached to Amazon S3 buckets.
• Amazon CloudWatch Logs: Amazon CloudWatch Logs collects and monitors log data, but does not manage access permissions.
• AWS CloudTrail: AWS CloudTrail records API activity for auditing and governance.
Q11: Intelligent Threat Detection & Machine Learning
Which AWS service uses intelligent threat detection and machine learning to continuously monitor AWS accounts and workloads for malicious activity, unauthorized behavior, and malware?
• Amazon GuardDuty: Amazon GuardDuty is an intelligent threat detection service that continuously monitors AWS accounts, CloudTrail logs, VPC flow logs, and DNS logs to identify malicious activities, unauthorized access, and malware infections.
Why are the other options incorrect?
• Network Access Control Lists (network ACLs): Network ACLs filter network packets based on IP, port, and protocol rules at the subnet boundary without threat intelligence.
• AWS WAF: AWS WAF is a Layer 7 firewall that filters web exploits targeting web applications.
• AWS Network Firewall: AWS Network Firewall provides stateful network traffic inspection at the VPC boundary, but does not provide machine-learning-driven threat intelligence and account monitoring.
Q12: Managed DDoS Attack Mitigation
Which AWS service provides managed protection against Distributed Denial of Service (DDoS) attacks for applications and workloads running on AWS?
• AWS Shield: AWS Shield is a managed DDoS protection service. AWS Shield Standard provides automatic protection against common Layer 3 and Layer 4 attacks at no extra charge, while AWS Shield Advanced provides enhanced DDoS detection, automated mitigation, and 24/7 access to the AWS Shield Response Team (SRT).
Why are the other options incorrect?
• Amazon GuardDuty: Amazon GuardDuty detects security threats from logs, but does not mitigate DDoS attacks inline.
• Network ACLs: Network ACLs provide basic IP/port filtering at the subnet level, but cannot automatically absorb large-scale distributed DDoS traffic.
• Security groups: Security groups act as instance-level firewalls and do not provide automated DDoS mitigation.
Q13: Cryptographic Key Management & Data at Rest
Which AWS service is used to create and manage the cryptographic keys required to encrypt Amazon EBS volumes and snapshots at rest?
• AWS Key Management Service (AWS KMS): AWS Key Management Service (AWS KMS) allows you to create, manage, and control cryptographic keys (KMS keys) used to encrypt data at rest across AWS services, including Amazon EBS volumes and snapshots.
Why are the other options incorrect?
• AWS Certificate Manager (ACM): AWS Certificate Manager (ACM) provisions and manages SSL/TLS certificates used to secure data in transit.
• AWS Systems Manager: AWS Systems Manager provides operational tools for managing node configurations and patching.
• AWS Config: AWS Config continuously monitors and records AWS resource configurations for compliance.
Q14: AWS Security & Encryption Architecture (Yes/No)
Review the three statements below regarding AWS Security and Encryption. Determine whether each statement is Yes (True) or No (False):
1. Security groups are stateless firewalls that require explicit rules for both inbound and outbound return traffic.
2. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost to protect against Layer 3 and Layer 4 DDoS attacks.
3. All newly created Amazon S3 buckets automatically enable server-side encryption (SSE-S3) by default.
• Statement 1 is NO (False): Security groups are stateful. If you send a request from an instance, the response traffic is automatically allowed regardless of inbound rules. (Network ACLs are stateless).
• Statement 2 is YES (True): AWS Shield Standard is automatically applied to all AWS customers at no extra cost, defending against common Layer 3 and Layer 4 DDoS attacks.
• Statement 3 is YES (True): AWS enforces default encryption (SSE-S3) for all new object uploads in every Amazon S3 bucket at no extra cost.
Q15: AWS Security & Compliance Services (Matching)
Match each description below to its corresponding AWS Security Service:
1. Provides on-demand access to AWS compliance reports (e.g., SOC, PCI-DSS) and security agreements:
2. Provides dedicated, single-tenant hardware security module (HSM) appliances under direct customer control:
3. Uses graph modeling and log analysis to investigate the root cause and scope of potential security incidents:
4. Automatically rotates, manages, and retrieves database passwords and API tokens throughout their lifecycle:
• AWS Artifact: Central portal for on-demand downloads of AWS compliance reports, certifications, and agreements.
• AWS CloudHSM: Provides dedicated, single-tenant hardware security modules.
• Amazon Detective: Automatically collects log data and uses graph analysis to visualize and investigate root causes of security findings.
• AWS Secrets Manager: Handles storage, retrieval, and automated rotation of credentials.
Q16: Security Groups vs. Network ACLs (Select 2)
Which TWO statements correctly describe the differences between Security Groups and Network Access Control Lists (Network ACLs)? (Select TWO)
• Instance vs. Subnet Level: Security groups filter traffic directly at the EC2 instance level, while Network ACLs control traffic across the entire subnet boundary.
• Stateful vs. Stateless: Security groups are stateful (return traffic is automatically allowed), whereas Network ACLs are stateless (inbound and outbound rules are evaluated independently).
Why are the other options incorrect?
• Option B: Security groups are stateful, not stateless.
• Option D: Security groups only support ALLOW rules, whereas Network ACLs support both ALLOW and DENY rules.
• Option E: Both are VPC-level networking features.
Q17: SSL/TLS Certificates & Encryption in Transit
A company needs to provision, manage, and automatically renew public SSL/TLS certificates to secure network traffic in transit for its web applications.
Which AWS service should the company use?
• AWS Certificate Manager (ACM): AWS Certificate Manager (ACM) allows you to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services like Elastic Load Balancing and Amazon CloudFront, including automated certificate renewals.
Why are the other options incorrect?
• AWS Key Management Service (AWS KMS): AWS KMS manages cryptographic keys for data encryption at rest.
• AWS Secrets Manager: AWS Secrets Manager stores and rotates credentials and API tokens.
• AWS Shield: AWS Shield provides DDoS attack protection.
Q18: AWS Security & Protection Services (Matching)
Match each security capability below to the corresponding AWS Security & Protection Service:
1. Inspects incoming HTTP and HTTPS traffic to block web exploits such as SQL injection and Cross-Site Scripting (XSS):
2. Continuously analyzes cloud telemetry (CloudTrail, VPC Flow Logs, DNS) using machine learning to detect unauthorized behaviors and compromised instances:
3. Performs automated vulnerability assessments for software packages (CVEs) and unintended network exposure on compute workloads:
4. Provides 24/7 access to the AWS Shield Response Team (SRT) and financial DDoS cost protection for scaling workloads:
• AWS WAF: Filters Layer 7 HTTP/HTTPS traffic against web exploits.
• Amazon GuardDuty: Provides intelligent threat intelligence monitoring across account activities.
• Amazon Inspector: Scans compute workloads (EC2, ECR, Lambda) for software vulnerabilities and CVEs.
• AWS Shield Advanced: Provides enterprise-tier DDoS mitigation, 24/7 Shield Response Team (SRT) support, and cost protection against spikes caused by attacks.
Q19: Subnet-Level Traffic Filtering (Network ACLs)
Which AWS networking feature acts as a firewall at the subnet level to control inbound and outbound traffic entering and exiting a subnet?
• Network Access Control Lists (network ACLs): Network Access Control Lists (network ACLs) are stateless virtual firewalls that operate at the subnet level to control traffic entering and leaving all resources within that subnet.
Why are the other options incorrect?
• Security groups: Security groups operate as stateful virtual firewalls at the instance (ENI) level.
• AWS Certificate Manager (ACM): AWS Certificate Manager (ACM) provisions and manages SSL/TLS certificates for secure HTTPS communication.
• AWS Config: AWS Config evaluates and tracks resource configuration changes for compliance.
Q20: Security Incident Investigation & Root Cause
A security operations center (SOC) analyst receives an alert about an EC2 instance communicating with a known malicious IP address. The analyst needs to quickly analyze, visualize, and determine the root cause and complete timeline of this security event across CloudTrail, VPC Flow Logs, and GuardDuty findings.
Which AWS service is specifically designed to conduct this root-cause investigation?
• Amazon Detective: Amazon Detective automatically collects log data from your AWS resources (GuardDuty, VPC Flow Logs, CloudTrail) and uses machine learning, statistical analysis, and graph theory to build an interactive view of security events, allowing analysts to quickly determine the root cause of potential security incidents.
Why are the other options incorrect?
• AWS CloudTrail: AWS CloudTrail records raw API activity logs, but it does not correlate graph data or provide automated root-cause security investigation tools.
• AWS Trusted Advisor: AWS Trusted Advisor offers best-practice optimization checks across cost, performance, and security.
• Amazon CloudWatch Logs: Amazon CloudWatch Logs stores and queries application/system logs, but lacks native graph analysis and automated threat investigation models.
Key Takeaways for AWS Security, Encryption & Threat Protection (Part 5 Summary)
• Web Application & DDoS Defense (AWS WAF vs. AWS Shield): AWS WAF protects Layer 7 (HTTP/HTTPS) web applications by blocking exploits like SQL injection (SQLi) and Cross-Site Scripting (XSS). AWS Shield Standard provides automatic, free protection against Layer 3/4 DDoS attacks, while AWS Shield Advanced offers 24/7 access to the AWS Shield Response Team (SRT) and financial DDoS cost protection.
• Threat Detection vs. Vulnerability Management: Amazon GuardDuty uses machine learning to analyze logs (CloudTrail, VPC Flow Logs, DNS) and detect active threats or compromised accounts in real time. In contrast, Amazon Inspector automatically scans compute workloads (Amazon EC2, container images in Amazon ECR, and AWS Lambda) for software vulnerabilities (CVEs) and unintended network exposure.
• Sensitive Data Discovery & Compliance (Amazon Macie & AWS Artifact): Amazon Macie uses machine learning and pattern matching to discover, classify, and protect sensitive data (such as PII and credit card numbers) stored in Amazon S3. AWS Artifact is the central on-demand portal to download AWS security agreements and compliance reports (such as SOC and PCI-DSS).
• Cryptographic Keys & Secrets Management: AWS KMS is a multi-tenant managed service used to create and manage encryption keys for data at rest. AWS CloudHSM provides dedicated, single-tenant hardware security modules for strict regulatory compliance. AWS Secrets Manager securely stores, retrieves, and automatically rotates database credentials and API keys on schedule.
• Network Security (Security Groups vs. Network ACLs): Security Groups act as stateful virtual firewalls at the Amazon EC2 instance level and only support ALLOW rules. Network ACLs act as stateless firewalls at the subnet level, processing both ALLOW and DENY rules in strict numerical order.
Frequently Asked Questions (AWS CLF-C02 FAQ)
1. What is the difference between Security Groups and Network ACLs in AWS?
Security Groups operate at the individual Amazon EC2 instance (network interface) level and are stateful—if inbound traffic is allowed, the outbound return traffic is automatically permitted regardless of outbound rules. They support only ALLOW rules. On the other hand, Network Access Control Lists (Network ACLs) operate at the entire subnet level and are stateless—inbound and outbound traffic rules must be explicitly configured separately. Network ACLs support both ALLOW and DENY rules and evaluate them in numerical order, starting with the lowest numbered rule.
2. How do AWS KMS and AWS CloudHSM differ for data encryption?
AWS Key Management Service (AWS KMS) is a fully managed, multi-tenant encryption service integrated across dozens of AWS services. AWS manages the underlying hardware security modules, and plaintext KMS root keys can never leave the HSM. AWS CloudHSM is designed for organizations with strict compliance or regulatory mandates requiring dedicated, single-tenant FIPS 140-2 Level 3 hardware appliances inside their VPC, where the customer maintains exclusive control over key generation and management.
3. What is the fundamental difference between Amazon GuardDuty, Amazon Inspector, and Amazon Macie?
Each service focuses on a different security domain: Amazon GuardDuty is an intelligent threat detection service that monitors AWS account activity and network logs for unauthorized behavior and active attacks. Amazon Inspector is a vulnerability management tool that scans software packages on EC2 instances, ECR container images, and Lambda functions for known security flaws (CVEs). Amazon Macie is a data privacy and security service that scans Amazon S3 buckets using machine learning to discover and classify sensitive data like Personally Identifiable Information (PII).
4. What is the difference between AWS WAF and AWS Shield?
AWS WAF is a Web Application Firewall that operates at Layer 7 (Application Layer) to inspect incoming HTTP and HTTPS traffic, filtering out malicious requests such as SQL Injection (SQLi) and Cross-Site Scripting (XSS). AWS Shield is a managed service designed to protect workloads from Layer 3 (Network) and Layer 4 (Transport) Distributed Denial of Service (DDoS) attacks, such as SYN floods and UDP reflection attacks.
Ready to See Your Results?
Congratulations on completing all 20 questions of this aws cloud practitioner practice test free module! Securing cloud architecture, protecting sensitive data with encryption, and detecting threats are core competencies tested extensively on the AWS Certified Cloud Practitioner (CLF-C02) exam.
Review any questions you answered incorrectly, make sure you thoroughly understand the key security takeaways and FAQ breakdowns above, and continue your certification journey with our next module on AWS Compute Services.
