CLF-C02 Security & Compliance Security & Compliance Practice Questions

AWS Artifact is a self-service portal that provides on-demand access to AWS security and compliance documents such as SOC reports, ISO certifications, PCI attestations, and other auditor-issued compliance materials.

Configuration management details are not available from Artifact; AWS Config tracks resource configuration history and CloudTrail logs API activity, but neither is reached through Artifact. Training materials come from AWS Training and Certification and AWS Skill Builder, not Artifact, which holds only compliance documents. A security assessment of deployed applications is performed by Amazon Inspector, which scans EC2 instances and container images for vulnerabilities, not by Artifact.

AWS publishes Security Bulletins to notify customers about security and privacy events affecting AWS services, providing details on vulnerabilities and recommended actions.

AWS Certificate Manager is a service that provisions and manages SSL/TLS certificates for use with AWS resources, and is not a channel through which AWS communicates security or privacy event notifications to customers. The AWS Management Console is a web-based interface for accessing and managing AWS services, and while customers can view some account-level alerts there, it is not the mechanism AWS uses to publish security and privacy event notifications. AWS Compliance Resources are documents and reports such as audit certifications and compliance guides that help customers understand AWS's regulatory posture, and are not used to notify customers about specific security or privacy events.

Updating the host firmware on EC2 physical servers is AWS's responsibility, as customers have no access to or control over the underlying hardware beneath their instances.

Granting access to individuals and services is the customer's responsibility, as customers manage their own IAM users, roles, and permissions within their AWS account. Encrypting data in transit is the customer's responsibility, as customers decide whether and how to implement encryption for their own data using HTTPS, TLS, or other mechanisms. Updating operating systems is the customer's responsibility on services like EC2, where customers control the guest OS and are accountable for keeping it patched and up to date.

AWS CloudHSM provides dedicated, single-tenant hardware security modules within the AWS Cloud that meet FIPS 140-2 Level 3 compliance requirements, offering complete customer control over key generation and management on dedicated hardware for organizations with strict contractual or regulatory mandates.

AWS Secrets Manager stores, rotates, and manages secrets such as database credentials and API keys; it handles the secret lifecycle rather than providing dedicated hardware appliances. AWS KMS uses HSMs but shares the underlying hardware across customers, so it does not offer the dedicated single-tenant hardware that some contractual or regulatory requirements mandate. AWS Directory Service provides managed Microsoft Active Directory for identity management and single sign-on, with no connection to hardware security modules or key management.

The AWS Abuse Team handles reports of AWS infrastructure being used for malicious activity such as hacking, spam, or unauthorised use, and this channel is available to all customers regardless of their support tier.

The AWS Customer Service team handles general account and billing enquiries, and is not the designated contact for reporting malicious use of AWS infrastructure. The AWS Concierge team is a dedicated support resource available exclusively to Enterprise support plan customers for billing and account assistance, and does not handle abuse or malicious activity reports. The AWS Security team manages AWS's own internal security posture and vulnerability disclosure program, and is not the correct channel for customers to report malicious use of AWS resources within their own accounts.