Free CLF-C02 practice questions: KMS, Shield & WAF

Three security services the exam pairs by what they protect: keys, traffic volume, and web requests. Seven questions, 2026 edition.

Here are 7 typical KMS, Shield and WAF questions in the exam's own style — free, with the answer explained, no sign-up.

Straight to the 7 free questions ↓

Three security services get grouped together on the CLF-C02 because their names are easy to swap: KMS, Shield and WAF. Each protects a different thing, and the exam almost always tests whether you can keep those three things — plus one distinction about encryption — straight.

One word each

KMS protects data with keys. It creates and controls the encryption keys used to encrypt data, and integrates with services across AWS.
Shield protects against volume. It defends against DDoS attacks — floods of traffic meant to knock a service offline. Shield Standard is automatic and free for everyone; Shield Advanced is a paid tier with more protection.
WAF protects against requests. It is a web application firewall: you write rules to allow or block web requests by conditions such as IP address, matching patterns or request rate. A WAF web ACL sits in front of CloudFront, an Application Load Balancer or API Gateway.

Keys, volume, requests. If you can attach that one word to each, most of these questions answer themselves — and you will not be fooled when a distractor offers Shield for SQL injection (that is WAF) or KMS for DDoS (that is Shield).

The encryption distinction: in transit vs at rest

One idea underneath KMS trips people up: where the data is being protected.

At rest — data sitting in storage. Encrypted using keys from KMS.
In transit — data moving between a client and a service. Encrypted with TLS/SSL, using certificates that AWS Certificate Manager can provide.

So a question about protecting data as it travels points to TLS/ACM, not KMS. A question about protecting stored data points to KMS. Same goal, two different mechanisms, and the exam likes to see whether you know which is which.

How to use the questions below

Answer each one before opening the explanation, then read past the correct letter to why the other three fail. The distractors are always the neighbouring service — Shield where WAF belongs, KMS where ACM belongs. Sorting them by what each one protects is the whole skill, and the reasoning below is built to make it automatic.

Three AWS security services separated by what they protect: AWS KMS manages the encryption keys that protect data at rest, AWS Shield defends against DDoS traffic-volume attacks, and AWS WAF filters web requests by rules. A note distinguishes encryption in transit with TLS from encryption at rest with KMS.

7 free CLF-C02 practice questions

Answers and explanations — no email wall

CLF-C02 Question 1 of 7

Which statement about AWS Shield is correct?

Answer: A — Shield Standard is included automatically at no extra cost and protects against common DDoS attacks

AWS Shield Standard is on for every customer at no additional charge and defends against common DDoS attacks; Shield Advanced is a paid tier with more protection and support. Why not the others: you are not unprotected until you pay — Standard is automatic. Filtering SQL injection is AWS WAF's job. Encrypting data at rest is KMS. Shield is about traffic volume.

CLF-C02 Question 2 of 7

Where is an AWS WAF web ACL commonly applied?

Answer: A — In front of Amazon CloudFront, an Application Load Balancer or API Gateway

A WAF web ACL is associated with the entry points that receive web traffic — CloudFront, an Application Load Balancer, or API Gateway — where it can inspect and filter requests. Why not the others: an instance store volume is temporary disk, unrelated to web filtering. IAM policies grant permissions, they do not filter HTTP requests. And WAF is not attached to S3 object metadata. WAF sits at the web front door.

CLF-C02 Question 3 of 7

What is the difference between an AWS managed key and a customer managed key in AWS KMS?

Answer: A — A customer managed key gives you control over its rotation and key policy; an AWS managed key is created and handled by AWS for you

Customer managed keys are ones you create and control — including rotation settings and the key policy — while AWS managed keys are created and managed by AWS on your behalf for a service. Why not the others: customer managed keys can be rotated (that is part of the control they give you). Both kinds encrypt data. And they are clearly different, which is what the question checks.

CLF-C02 Question 4 of 7

A company wants to protect data while it travels between a user's browser and its web service — that is, in transit. What is used for this?

Answer: A — TLS/SSL, using certificates (for example from AWS Certificate Manager)

Encryption in transit uses TLS/SSL, with certificates that AWS Certificate Manager can provision and renew. Why not the others: KMS manages keys for encryption at rest, a different problem. Shield is DDoS protection. A bucket policy controls access to S3, not transport encryption. In transit means TLS; at rest means KMS — keep the two apart.

CLF-C02 Question 5 of 7

A service is being overwhelmed by a flood of traffic designed to make it unavailable. Which AWS service defends against this?

Answer: A — AWS Shield

A flood of traffic to knock a service offline is a DDoS attack, and AWS Shield is the DDoS defence. Why not the others: WAF filters the content of web requests (like malicious patterns), not sheer volume. KMS manages encryption keys. Macie discovers sensitive data in S3. Volume is Shield; request content is WAF — that is the pairing the exam tests.

CLF-C02 Question 6 of 7

What does AWS WAF let you do?

Answer: A — Create rules to allow or block web requests based on conditions such as IP address, patterns or request rate

AWS WAF is a web application firewall: you write rules that allow or block requests based on conditions, including IP addresses, matching patterns and request rate. Why not the others: managing encryption keys is KMS. A designated TAM is part of Enterprise Support. AWS's compliance reports live in AWS Artifact. WAF's job is filtering web requests by your rules.

CLF-C02 Question 7 of 7

What does AWS KMS primarily manage?

Answer: A — The creation and control of encryption keys used to encrypt data

AWS Key Management Service creates and controls the encryption keys that protect your data, and integrates with many AWS services. Why not the others: TLS certificates are AWS Certificate Manager. Passwords and secrets are AWS Secrets Manager. DDoS protection is Shield. KMS is specifically about encryption keys.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 390 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

390 questions in 6 full tests, CLF-C02 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Is this the current CLF-C02 format?

Yes — these questions follow the CLF-C02 exam guide (2026 edition). KMS, Shield and WAF sit in the Security and Compliance domain, the heaviest on the exam at 30%, and the exam reliably tests the boundaries between these named services.

Are these real exam questions?

No. They are our own questions, written in the style and difficulty of the exam. Reproducing real exam items breaks the AWS certification agreement and can cost you your certification — and a memorised item teaches you nothing about the one you have not seen.

Do I need to configure these services for the exam?

No. CLF-C02 tests what each service protects — KMS the keys, Shield against traffic volume, WAF the web requests — and the difference between encryption in transit and at rest. You will not write a WAF rule or a key policy by hand.

What is the one-line separation of the three?

KMS protects data with keys; Shield protects against DDoS traffic volume; WAF filters web requests by rules. Keys, volume, requests. Attach one word to each and the questions sort themselves.

Updated for CLF-C02 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.