Objective 2.4CLF-C02

2.4 Identify components and resources for security.

Objective 2.4 sits in Security and Compliance, which carries 30% of the Cloud Practitioner exam. The questions below are original, written from the official objective title above, and each explanation cites the Amazon Web Services (AWS) page it rests on.

Objective title verbatim from the official objectives. Amazon Web Services (AWS) exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-4Security and ComplianceModerate

A security team wants continuous threat detection across an account without deploying agents or turning on extra logging first. Which service works from data already there?

Amazon GuardDutyCorrect · your answerCorrect. It ingests the account's foundational data sources on its own.
AWS ConfigConfig records how resources are configured and whether they drift from a rule. It does not read threat intelligence or flag malicious activity.
Amazon InspectorInspector looks for software vulnerabilities and open network paths in workloads, which is a different question from whether an attack is under way.
AWS Trusted AdvisorTrusted Advisor checks an account against best practice categories such as cost and fault tolerance, not live threat telemetry.

Correct.

Concept

Detection can be built on telemetry a platform already produces. Reading control plane, network and name resolution records means monitoring starts the moment it is switched on, with nothing installed on a host.

Why A

Enabling it starts ingestion of the foundational data sources for the account, meaning CloudTrail management events, VPC flow logs and DNS logs, and findings follow without any further configuration.

Source

#guardduty#threat-detection#monitoring

Now you: objective 2.4 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-4Security and ComplianceEasy

A team must find known software vulnerabilities in EC2 instances, ECR container images and Lambda functions. Which service is built for that?

Sample question 2 of 3

2-4Security and ComplianceHard

An engineer asks when Amazon Inspector will re-examine an instance that scanned clean last week. What causes a rescan?

Sample question 3 of 3

2-4Security and ComplianceModerate

Requests carrying SQL injection strings are reaching an application behind an Application Load Balancer. Which control inspects and blocks those HTTP requests?

That’s 3 of the full Cloud Practitioner bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security and Compliance