Amazon Web Services Updated CLF-C02 Exam Questions and Answers by jaylen

Under theAWS Shared Responsibility Model, AWS manages securityofthe cloud (such as physical infrastructure and virtualization), while customers are responsible for securityinthe cloud. This means that customers are responsible for:

B. Encrypt data and maintain data integrity: Correct, as customers are responsible for securing their data, including encryption and maintaining its integrity.

D. Maintain identity and access management controls: Correct, as customers are responsible for managing access to their AWS resources, including creating and managing IAM users, roles, and permissions.

A. Secure the virtualization layer: Incorrect, as AWS is responsible for securing the underlying virtualization layer.

C. Patch the Amazon RDS operating system: Incorrect, as AWS handles patching and maintenance of the managed service’s underlying infrastructure.

E. Secure Availability Zones: Incorrect, as AWS is responsible for securing the physical infrastructure, including Availability Zones.

AWS Cloud References:

AWS Shared Responsibility Model

AWS CloudTrail is a service that enables governance, compliance, and operational and risk auditing of an AWS account. It logs, continuously monitors, and retains account activity related to actions across an AWS infrastructure.

For auditing purposes:

CloudTrail records AWS API calls made in the account, including details about who made the request, the services used, the actions performed, and the response elements returned by AWS.

This information is critical for understanding user activity, detecting anomalous behavior, and performing security analysis and compliance auditing.

Why other options are not suitable:

A. AWS Config: AWS Config provides a detailed view of the configuration of AWS resources, including how resources are related and their compliance with internal policies, but it does not provide a comprehensive audit trail of user actions.

B. Amazon Rekognition: A service for image and video analysis, not relevant to auditing AWS account activity.

D. Amazon SNS: A notification service for sending alerts and messages, not used for auditing purposes.

AWS Glue is a serverless data integration service that makes it easy to discover, prepare, move, and integrate data from multiple sources for analytics, machine learning, and application development. You can use various data integration engines, such as ETL, ELT, batch, and streaming, and manage your data in a centralized data catalog. AWS Glue is designed specifically for extract, transform, and load (ETL) data, whereas the other options are not.

ANetwork ACL (Access Control List)is a stateless firewall that controls inbound and outbound traffic at the subnet level within a VPC. It provides an additional layer of security to the VPC by allowing or denying traffic to and from a subnet based on defined rules.

A. Security group: Incorrect, as security groups act as a firewall at the instance level, not the subnet level.

C. Elastic network interface: Incorrect, as it is a virtual network interface that you can attach to an instance, not a firewall feature.

D. AWS WAF: Incorrect, as it is a web application firewall that protects web applications from common exploits, not for subnet-level protection.

AWS Cloud References:

Network ACLs