CLF-C02 exam dumps: questions 101 to 200 of 341

Correct answer: A

• A. Correct.

  AWS Secrets Manager is designed specifically for securely storing and managing secrets like API keys, database credentials, and other sensitive information. It also supports automatic secret rotation.

• B. Incorrect.

  AWS Systems Manager Parameter Store can store configuration data and secrets, but it lacks some advanced features like automatic secret rotation provided by AWS Secrets Manager.

• C. Incorrect.

  Amazon S3 with public-read access is not intended for storing sensitive credentials. Public-read access would expose sensitive information to anyone on the internet, which is a significant security risk.

• D. Incorrect.

  AWS Key Management Service (KMS) is used for encrypting and managing cryptographic keys, not for storing credentials or secrets directly.

Correct answer: B

• A. Incorrect.

  Storing credentials in plain text in an S3 bucket is insecure, even if public access is disabled. Sensitive information should not be stored in plain text.

• B. Correct.

  AWS Secrets Manager is designed to securely store and manage sensitive information such as credentials. It also provides features like automatic rotation of secrets, making it the most appropriate solution in this scenario.

• C. Incorrect.

  Storing credentials in an EC2 instance's user data script is insecure and not a recommended best practice because the data could be exposed in logs or through other vulnerabilities.

• D. Incorrect.

  AWS Systems Manager Parameter Store with encryption is a viable solution for storing sensitive information, but AWS Secrets Manager is specifically designed for managing secrets like database credentials and offers additional features like secret rotation.

Correct answer: A

• A. Correct.

  Enabling multi-factor authentication (MFA) for all IAM users adds an additional layer of security, requiring users to provide a second factor (e.g., a one-time code) along with their password. This is the most effective solution for enhancing authentication security.

• B. Incorrect.

  Cross-account IAM roles are used to grant access between AWS accounts but do not specifically enhance authentication for AWS Management Console access.

• C. Incorrect.

  AWS IAM Identity Center (SSO) simplifies access management for multiple AWS accounts and third-party applications but does not directly enforce stronger authentication for console access.

• D. Incorrect.

  Disabling root user access is a good practice but does not address the requirement for enhancing authentication for general users accessing the AWS Management Console.

Correct answer: A

• A. Correct.

  Enabling Multi-Factor Authentication (MFA) is the most appropriate solution to add an additional layer of authentication for IAM users. MFA requires users to provide a second factor (like a code from a mobile app) in addition to their password, enhancing security.

• B. Incorrect.

  Using IAM Identity Center to enforce password complexity policies can improve password strength but does not provide an additional layer of authentication like MFA does.

• C. Incorrect.

  Cross-account IAM roles are used to grant access to resources across accounts, not to enforce additional layers of authentication.

• D. Incorrect.

  AWS WAF is a web application firewall that protects applications from web-based threats but does not address user authentication for the AWS Management Console.

Correct answers: A, B

• A. Correct.

  Enabling AWS IAM Identity Center allows integration with the corporate identity provider, enabling users to authenticate using their corporate credentials. This meets the requirement for corporate credential-based authentication.

• B. Correct.

  Enabling MFA adds an additional layer of security, meeting the requirement for multi-factor authentication in the AWS Management Console.

• C. Incorrect.

  Cross-account IAM roles are used for granting access between AWS accounts, not for enabling authentication with corporate credentials or MFA.

• D. Incorrect.

  IAM policies can enforce MFA for access to AWS resources but do not directly handle integration with corporate credentials for authentication.

• E. Incorrect.

  Amazon Cognito is used primarily for building authentication mechanisms for web and mobile applications, not for AWS Management Console access with corporate credentials.