ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Security services / Question 1

CLF-C02 practice question: Security services (1 of 3)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A security lead needs two capabilities.

First, continuous scanning of Amazon EC2 instances, container images in Amazon ECR and Lambda functions for software vulnerabilities.

Second, one dashboard that combines findings from GuardDuty and Macie and checks them against a security standard.

Which TWO services meet these needs? (Choose two.)

Choose two answers.

  1. A. Amazon Detective, which helps investigate the root cause of security findings
  2. B. Amazon Inspector, which continually scans workloads for software vulnerabilities
  3. C. AWS Firewall Manager, which applies firewall rules centrally across accounts
  4. D. AWS Security Hub, which combines findings and checks them against security standards
  5. E. Amazon Macie, which discovers sensitive data stored in Amazon S3 buckets
Show the answer and explanation

Answers: B, D

  • A. Wrong: Detective helps investigate the root cause of security findings by linking related activity. It does not scan for software vulnerabilities or run standards checks.
  • B. Right: Correct. Inspector discovers EC2 instances, ECR container images and Lambda functions, and continually scans them for software vulnerabilities. Learn more: What is Amazon Inspector? (opens in a new tab)
  • C. Wrong: Firewall Manager applies firewall rules centrally across accounts. It does not scan software for vulnerabilities or collect findings from other services.
  • D. Right: Correct. Security Hub receives findings from GuardDuty, Inspector and Macie, and runs checks against standards such as the AWS Foundational Security Best Practices. Learn more: What is AWS Security Hub CSPM? (opens in a new tab)
  • E. Wrong: Macie discovers sensitive data in Amazon S3. It does not scan EC2 instances or container images for vulnerabilities, and it is one of the sources Security Hub combines.

Explanation

Amazon Inspector continually scans EC2 instances, ECR container images and Lambda functions for software vulnerabilities. AWS Security Hub aggregates findings from GuardDuty, Inspector and Macie, and checks them against standards such as the AWS Foundational Security Best Practices. Detective, Firewall Manager and Macie each cover a different job.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice Security servicesAll Security services questions

Want more on Security services? The 5 full-length practice sets have 14 more Security services questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets