Objective 2.4
CLF-C02Identify components and resources for security.
Objective 2.4 sits in Security and Compliance, which carries 30% of the Cloud Practitioner exam. The questions below are original, written from the official objective title above, and each explanation cites the Amazon Web Services (AWS) page it rests on.
Objective title verbatim from the official objectives. Amazon Web Services (AWS) exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A security team wants continuous threat detection across an account without deploying agents or turning on extra logging first. Which service works from data already there?
Correct.
Checked against docs.aws.amazon.com, August 2026Concept
Detection can be built on telemetry a platform already produces. Reading control plane, network and name resolution records means monitoring starts the moment it is switched on, with nothing installed on a host.
Why A
Enabling it starts ingestion of the foundational data sources for the account, meaning CloudTrail management events, VPC flow logs and DNS logs, and findings follow without any further configuration.
Source
AWS Docs: What is Amazon GuardDuty, checked August 2026Foundational threat detection - When you enable GuardDuty in an AWS account, GuardDuty automatically starts ingesting the foundational data sources associated with that account. These data sources include AWS CloudTrail management events, VPC flow logs (from Amazon EC2 instances), and DNS logs. You don't need to enable anything else for GuardDuty to start analyzing and processing these data sources to generate associated security findings.
Now you: objective 2.4 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team must find known software vulnerabilities in EC2 instances, ECR container images and Lambda functions. Which service is built for that?
Sample question 2 of 3
An engineer asks when Amazon Inspector will re-examine an instance that scanned clean last week. What causes a rescan?
Sample question 3 of 3
Requests carrying SQL injection strings are reaching an application behind an Application Load Balancer. Which control inspects and blocks those HTTP requests?
That’s 3 of the full Cloud Practitioner bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.