ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Security services / Question 3

CLF-C02 practice question: Security services (3 of 3)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A security operations team wants an alert when an EC2 instance contacts IP addresses known to be malicious, or when an IAM access key is used in a suspicious way.

It does not want to build its own log pipeline.

Which service should it enable?

Choose one answer.

  1. A. AWS Config, which evaluates resource settings against compliance rules
  2. B. Amazon Inspector, which scans EC2 instances for software vulnerabilities
  3. C. AWS WAF, which filters HTTP requests sent to a web application
  4. D. Amazon GuardDuty, which analyzes foundational data sources to detect threats
Show the answer and explanation

Answer: D

  • A. Wrong: Config checks whether resource settings match your rules. It does not analyze logs to detect threats such as malicious traffic or stolen access keys.
  • B. Wrong: Inspector finds software vulnerabilities and network exposure. It does not monitor live traffic or API activity for signs of an attack.
  • C. Wrong: WAF filters web requests to an application. It does not analyze CloudTrail, VPC flow or DNS logs for threats on EC2 instances.
  • D. Right: Correct. Once enabled, GuardDuty analyzes CloudTrail management events, VPC flow logs and DNS logs with no further setup. It uses threat intelligence, such as lists of malicious IP addresses, and detects compromised credentials. Learn more: What is Amazon GuardDuty? (opens in a new tab)

Explanation

GuardDuty analyzes CloudTrail management events, VPC flow logs and DNS logs once it is enabled, so there is no pipeline to build. It uses threat intelligence such as lists of malicious IP addresses, and it detects threats including compromised credentials and cryptomining. Config, Inspector and WAF each cover a different job.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice Security servicesAll Security services questions

Want more on Security services? The 5 full-length practice sets have 14 more Security services questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets