Cert Master

CLF-C02 Domain 2: Security and Compliance

Which network feature acts as a virtual firewall at the instance level in a VPC?

Multiple choice — select one answer

Answer choices

  1. a. Security group
  2. b. AWS STS (Security Token Service), without security or identity team coordination per policy.
  3. c. Security in the cloud (customer responsibility)
  4. d. AWS Security Hub, without security or identity team coordination per policy.

Architectural breakdown & explanation

Security groups are stateful firewalls for EC2 instances and ENIs.

Correct answer(s): a. Security group

Exam domain: Domain 2: Security and Compliance (30% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the AWS Certified Cloud Practitioner bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications