Security services: CLF-C02 study notes and practice questions
What to know about Security services for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 3 free questions to test it. Part of the CLF-C02 study guide.
Cloud Practitioner questions name a security need and offer four security services as options. One sentence per service is enough to answer most of them.
Service
One-line job
Amazon GuardDuty
Detects threats such as compromised credentials or cryptomining by analyzing CloudTrail, VPC Flow Logs and DNS logs
Amazon Inspector
Scans EC2 instances, container images and Lambda functions for software vulnerabilities
Amazon Macie
Finds sensitive data, such as personal information, in Amazon S3
AWS Security Hub
Collects security findings from many services and checks your accounts against best practices
Amazon Detective
Helps investigate the root cause of security findings
AWS Shield
Protects against DDoS attacks; Standard is automatic and free, Advanced is a paid upgrade with response team support
AWS WAF
A web application firewall that filters HTTP requests, such as SQL injection or bad bots, on CloudFront, load balancers and API Gateway
AWS Firewall Manager
Manages WAF, Shield and security group rules across many accounts
AWS Network Firewall
A managed firewall for traffic in and out of a VPC
AWS Trusted Advisor
Checks your account against best practices, including some security checks
Network security basics
Security groups act as a firewall for instances, allow rules only, and are stateful.
Network ACLs act as a firewall for subnets, allow and deny rules, and are stateless.
Where to learn more
AWS publishes security guidance in the AWS Security Center, the AWS Security Blog, AWS Knowledge Center and AWS re:Post. AWS Marketplace offers third-party security products.
Common traps
GuardDuty vs Inspector. GuardDuty spots threats in activity; Inspector spots vulnerabilities in software.
Macie vs GuardDuty. Macie is about sensitive data; GuardDuty is about malicious activity.
Shield vs WAF. Shield stops DDoS floods; WAF filters harmful web requests.
First, continuous scanning of Amazon EC2 instances, container images in Amazon ECR and Lambda functions for software vulnerabilities.
Second, one dashboard that combines findings from GuardDuty and Macie and checks them against a security standard.
Which TWO services meet these needs? (Choose two.)
Choose two answers.
AA. Amazon Detective, which helps investigate the root cause of security findings
BB. Amazon Inspector, which continually scans workloads for software vulnerabilities
CC. AWS Firewall Manager, which applies firewall rules centrally across accounts
DD. AWS Security Hub, which combines findings and checks them against security standards
EE. Amazon Macie, which discovers sensitive data stored in Amazon S3 buckets
Show the answer and explanation
Answers: B, D
A. Wrong: Detective helps investigate the root cause of security findings by linking related activity. It does not scan for software vulnerabilities or run standards checks.
C. Wrong: Firewall Manager applies firewall rules centrally across accounts. It does not scan software for vulnerabilities or collect findings from other services.
E. Wrong: Macie discovers sensitive data in Amazon S3. It does not scan EC2 instances or container images for vulnerabilities, and it is one of the sources Security Hub combines.
Explanation
Amazon Inspector continually scans EC2 instances, ECR container images and Lambda functions for software vulnerabilities. AWS Security Hub aggregates findings from GuardDuty, Inspector and Macie, and checks them against standards such as the AWS Foundational Security Best Practices. Detective, Firewall Manager and Macie each cover a different job.
A retailer has kept CSV exports in Amazon S3 for several years.
Some files contain customers' names, email addresses and national ID numbers, and the compliance team needs to find every bucket and object that holds this personal data.
Which AWS service is designed for this?
Choose one answer.
AA. Amazon GuardDuty, which detects threats such as compromised credentials
BB. Amazon Inspector, which scans EC2 and container images for vulnerabilities
CC. Amazon Macie, which discovers sensitive data such as PII in Amazon S3
DD. AWS Shield, which protects applications against distributed denial of service attacks
Show the answer and explanation
Answer: C
A. Wrong: GuardDuty analyzes account activity and logs to detect threats. It does not inspect the contents of S3 objects for personal data.
B. Wrong: Inspector scans workloads for software vulnerabilities, not the contents of files stored in S3. It cannot tell whether a file holds personal data, so it does not meet the requirement.
C. Right: Correct. Macie uses machine learning and pattern matching to discover sensitive data, including personally identifiable information (PII), in S3 buckets. Learn more: What is Amazon Macie? (opens in a new tab)
D. Wrong: Shield protects applications against DDoS attacks. It does not look at the data stored in the buckets.
Explanation
Amazon Macie is a data security service for Amazon S3. It discovers sensitive data such as PII using managed data identifiers, and it also evaluates bucket security, for example flagging a bucket that becomes publicly accessible.
A security operations team wants an alert when an EC2 instance contacts IP addresses known to be malicious, or when an IAM access key is used in a suspicious way.
It does not want to build its own log pipeline.
Which service should it enable?
Choose one answer.
AA. AWS Config, which evaluates resource settings against compliance rules
BB. Amazon Inspector, which scans EC2 instances for software vulnerabilities
CC. AWS WAF, which filters HTTP requests sent to a web application
DD. Amazon GuardDuty, which analyzes foundational data sources to detect threats
Show the answer and explanation
Answer: D
A. Wrong: Config checks whether resource settings match your rules. It does not analyze logs to detect threats such as malicious traffic or stolen access keys.
B. Wrong: Inspector finds software vulnerabilities and network exposure. It does not monitor live traffic or API activity for signs of an attack.
C. Wrong: WAF filters web requests to an application. It does not analyze CloudTrail, VPC flow or DNS logs for threats on EC2 instances.
D. Right: Correct. Once enabled, GuardDuty analyzes CloudTrail management events, VPC flow logs and DNS logs with no further setup. It uses threat intelligence, such as lists of malicious IP addresses, and detects compromised credentials. Learn more: What is Amazon GuardDuty? (opens in a new tab)
Explanation
GuardDuty analyzes CloudTrail management events, VPC flow logs and DNS logs once it is enabled, so there is no pipeline to build. It uses threat intelligence such as lists of malicious IP addresses, and it detects threats including compromised credentials and cryptomining. Config, Inspector and WAF each cover a different job.
Want more on Security services? The 5 full-length practice sets have 14 more Security services questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →