AIAI Agent Dev Labaiagentdev-lab.com
Sign in to save progressSign in
Menu

CLF-C02 · LESSON 2

Security and Compliance30% · 4 topics

Learn the AWS shared responsibility model, security, governance and compliance concepts, access management and security services.

2.1Understand the AWS shared responsibility model

2.1 Understand the AWS shared responsibility model.

Concept

In the shared responsibility model, AWS is responsible for “security of the cloud” (data centers, hardware, networking, virtualization), and customers for “security in the cloud” (data, IAM, OS updates, security groups, encryption settings). The more abstracted the service (EC2 → RDS → Lambda/S3), the smaller the customer’s responsibility.

How it works / steps

  1. Check the type of service you use (IaaS-like, managed or serverless)
  2. Check who is responsible for OS and middleware patches
  3. Always configure data encryption and access permissions as the customer’s responsibility
  4. Obtain AWS-side audit reports from AWS Artifact

Workplace example

On EC2, the customer patches the guest OS; on RDS, AWS applies DB engine patches and the customer sets the maintenance window.

Common confusions and exam tips

Mini quiz

Q1. In the shared responsibility model, what is always the customer’s responsibility regardless of service?

  1. Updating the hypervisor (virtualization software) running on EC2 physical hosts
  2. Redundancy of communication lines connecting Regions
  3. Maintaining network equipment inside data centers
  4. Classifying stored data and managing who can access it
Show answer and explanation

Answer: D Classifying stored data and managing who can access it

Data and its access permissions are the customer’s responsibility in both IaaS and managed services. Virtualization and physical networks are AWS’s responsibility.

Q2. Which best explains “security of the cloud” and “security in the cloud”?

  1. The former refers to on-premises and the latter to cloud security, and responsibilities are split the same way
  2. The former refers to free and the latter to paid security services
  3. The former is protecting infrastructure, handled by AWS; the latter is protecting data and settings, handled by the customer
  4. The former is protecting the OS, handled by the customer; the latter is protecting physical facilities, handled by AWS
Show answer and explanation

Answer: C The former is protecting infrastructure, handled by AWS; the latter is protecting data and settings, handled by the customer

AWS handles security of the cloud (infrastructure); the customer handles security in the cloud (data, settings, access permissions).

Reference links

2.2Understand security, governance and compliance concepts

2.2 Understand AWS Cloud security, governance, and compliance concepts.

Concept

Use AWS Artifact (reports such as SOC and ISO, and agreements) to prove compliance, AWS Config to record and evaluate configurations, AWS CloudTrail to record API activity, and AWS Organizations SCPs or AWS Control Tower to govern multiple accounts. Encrypt with AWS KMS (key management), configuring encryption at rest and in transit.

How it works / steps

  1. Confirm the regulations and standards required (personal data, industry standards)
  2. Obtain the relevant reports from AWS Artifact
  3. Record operations in all Regions with CloudTrail and detect rule violations with Config
  4. Set account-wide prohibitions with Organizations and SCPs

Workplace example

Asked in an audit “who changed the security group and when,” the team shows the operator and time from CloudTrail logs, and uses Config to show the current settings comply with the rules.

Common confusions and exam tips

Mini quiz

Q1. A customer list stored in Amazon S3 was viewable from outside because of a misconfiguration. Which explanation fits the shared responsibility model best?

  1. S3 is a managed service, so a misconfigured bucket public setting is AWS’s responsibility
  2. S3 data is encrypted automatically, so publishing it is not an information leak
  3. AWS automatically fixes public settings periodically, so the customer need not respond
  4. Bucket access settings are the customer’s responsibility, and the customer must review them
Show answer and explanation

Answer: D Bucket access settings are the customer’s responsibility, and the customer must review them

Even with managed services, data access settings are the customer’s responsibility. The customer prevents this with features such as S3 Block Public Access.

Q2. A business partner in the financial industry asked for “evidence of third-party certifications AWS holds.” Which is the most appropriate way to obtain it?

  1. Share AWS CloudTrail logs with the partner
  2. Apply to AWS Support to tour a data center and submit photos of the facilities
  3. Download the relevant compliance reports from AWS Artifact
  4. Enable AWS Config rules and submit the evaluation results
Show answer and explanation

Answer: C Download the relevant compliance reports from AWS Artifact

AWS’s own audit reports and certifications are obtained in AWS Artifact. Config and CloudTrail record the customer’s environment and are not evidence of AWS certifications.

Reference links

2.3Identify AWS access management capabilities

2.3 Identify AWS access management capabilities.

Concept

AWS Identity and Access Management (IAM) manages access with users, groups, roles and policies. Don’t use the root user for daily work; protect it with MFA. Centralize human access across multiple accounts with IAM Identity Center, and use IAM roles (temporary credentials) rather than long-term keys for apps and services.

How it works / steps

  1. Set up MFA on the root user and don’t create access keys
  2. Manage human access with IAM Identity Center and grant permissions to groups
  3. Design policies by the principle of least privilege
  4. Attach IAM roles to EC2 and Lambda instead of embedding access keys in code

Workplace example

For an app on EC2 to read S3, instead of writing access keys in a config file, attach to the instance an IAM role that allows only reading S3.

Common confusions and exam tips

Mini quiz

Q1. Which service checks an account against best practices, flagging things like a root user without MFA or public S3 buckets, and gives recommendations?

  1. AWS Config
  2. AWS CloudTrail
  3. AWS Trusted Advisor
  4. Amazon Inspector
Show answer and explanation

Answer: C AWS Trusted Advisor

Trusted Advisor inspects your account and provides recommendations on cost optimization, security, fault tolerance, performance, service quotas and so on—for example, a root user without MFA or public S3 buckets. [Other options] Config records configuration changes and evaluates them against rules. Inspector scans EC2 and containers for vulnerabilities. CloudTrail records API calls.

Q2. Immediately after creating an AWS account, which action should be taken for the root user?

  1. Set up MFA, don’t use it for daily work and prepare a separate identity for administration
  2. Share the root user password within the department so anyone can respond in an emergency
  3. Delete the root user to prevent account takeover
  4. Create root user access keys and configure them in automation scripts
Show answer and explanation

Answer: A Set up MFA, don’t use it for daily work and prepare a separate identity for administration

The root user has all permissions, so protect it with MFA and don’t use it for daily work. Avoid creating or sharing access keys. The root user cannot be deleted.

Reference links

2.4Identify components and resources for security

2.4 Identify components and resources for security.

Concept

Key security services: AWS WAF (defends web apps against attacks), AWS Shield (DDoS defense; Standard is free and automatic), Amazon GuardDuty (threat detection by analyzing logs), Amazon Inspector (automated vulnerability scanning), AWS Security Hub (aggregates security posture), Amazon Macie (discovers sensitive data in S3) and AWS Secrets Manager (manages and rotates credentials). On the network, use security groups (stateful) and network ACLs (stateless).

How it works / steps

  1. Put WAF and Shield in front of public web apps
  2. Enable GuardDuty to detect suspicious traffic and operations
  3. Scan EC2 and containers for vulnerabilities with Inspector
  4. Aggregate results in Security Hub and address the highest priorities first

Workplace example

GuardDuty detects traffic from EC2 to a known cryptocurrency mining server, and from the alert aggregated in Security Hub, staff isolate the instance.

Common confusions and exam tips

Mini quiz

Q1. When using Amazon EC2, which is NOT the customer’s responsibility?

  1. Updating applications installed on the instance
  2. Disposing of and wiping the physical hosts that instances run on
  3. Configuring ports allowed in security groups
  4. Managing OS user accounts and passwords
Show answer and explanation

Answer: B Disposing of and wiping the physical hosts that instances run on

Disposing of and wiping physical hosts and storage devices is AWS’s responsibility. Security groups, applications and OS accounts are managed by the customer.

Q2. You want to strengthen security inside Amazon VPC. Which feature specifies allowed traffic per instance?

  1. AWS WAF
  2. Security groups
  3. Network ACLs
  4. Route tables
Show answer and explanation

Answer: B Security groups

Security groups are virtual firewalls per instance (ENI) and are stateful. Network ACLs are per subnet and stateless. [Other options] NACLs are stateless and per subnet. Route tables control routing. WAF blocks HTTP attacks and is not per-instance traffic allowance.

Reference links

Lessons are written by this site based on public information and do not guarantee exam content. Product specifications change, so check the latest information at the reference links.

Notes (unofficial, original questions, no pass guarantee)