Exams / CLF-C02 / Security services / Question 1
CLF-C02 practice question: Security services (1 of 3)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company wants to (1) continuously scan its Amazon EC2 instances and container images for known software vulnerabilities, and (2) see findings from several AWS security services in one place, checked against security best-practice standards. Which TWO services meet these needs? (Choose two.)
Choose two answers.
- AA. Amazon Detective
- BB. Amazon Inspector
- CC. AWS Firewall Manager
- DD. AWS Security Hub
- EE. Amazon Macie
Show the answer and explanation
Answers: B, D
- A. Wrong: Detective helps investigate the root cause of security findings. It does not scan for vulnerabilities or run best-practice checks.
- B. Right: Correct. Inspector automatically discovers EC2 instances, ECR container images and Lambda functions and continually scans them for software vulnerabilities.
- C. Wrong: Firewall Manager centrally applies firewall rules across accounts. It does not scan software or aggregate findings from other services.
- D. Right: Correct. Security Hub collects findings from services such as GuardDuty, Inspector and Macie and runs checks against standards such as the AWS Foundational Security Best Practices.
- E. Wrong: Macie discovers sensitive data in Amazon S3. It does not scan EC2 instances for vulnerabilities.
Explanation
Amazon Inspector is AWS's vulnerability management service for EC2, container images and Lambda. AWS Security Hub (also shown in the console as Security Hub CSPM) gives a single view of security posture: it aggregates findings from AWS and partner security tools and runs continuous checks against security standards.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.