CLF-C02 Question 131
Single answerYour company is using AWS to host its applications and is concerned about identifying and mitigating potential security risks. Which AWS service can help you proactively identify security vulnerabilities, such as overly permissive IAM policies and exposed S3 buckets, and provide recommendations for resolving them?
- A
AWS Trusted Advisor
- B
Amazon Macie
- C
AWS WAF (Web Application Firewall)
- D
Amazon GuardDuty
Show answer and explanation
Correct answer: A
Explanation
AWS Trusted Advisor is the most appropriate service for identifying security vulnerabilities across your AWS resources and providing actionable recommendations. It is specifically designed to help optimize your AWS environment in areas such as cost, performance, fault tolerance, and security. Other services mentioned, like Amazon Macie, AWS WAF, and Amazon GuardDuty, address specific security concerns but do not serve the broader purpose of identifying and resolving vulnerabilities across your AWS setup.
- A. Correct.
AWS Trusted Advisor provides recommendations to optimize your AWS environment, including identifying security vulnerabilities such as overly permissive IAM roles, exposed S3 buckets, and more. It is the correct service for this use case.
- B. Incorrect.
Amazon Macie focuses specifically on discovering and protecting sensitive data, such as personally identifiable information (PII), stored in Amazon S3. While it is useful for data protection, it does not provide broad security recommendations across your AWS environment.
- C. Incorrect.
AWS WAF is used to protect web applications by filtering and monitoring HTTP and HTTPS requests. It does not proactively identify security vulnerabilities across your AWS resources.
- D. Incorrect.
Amazon GuardDuty is a threat detection service that monitors your AWS environment for malicious or unauthorized behavior. While it enhances security, it does not provide proactive recommendations for resolving vulnerabilities like AWS Trusted Advisor does.