CLF-C02 Security and Compliance Practice Question
A company has 200 IAM users. The security team needs to automatically verify that every IAM user has enabled multi-factor authentication (MFA) for console access. They also need to receive a notification whenever a new user is created without MFA so they can enforce the policy. Which AWS service should the security team use to meet these requirements?
⚠ Common exam trap
Many candidates confuse CloudTrail's API logging with Config's continuous compliance evaluation, assuming that recording user creation events is sufficient to enforce MFA, but CloudTrail lacks the ability to assess resource state or trigger notifications based on compliance status.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is correct because it provides managed rules like 'iam-user-mfa-enabled' that can continuously evaluate whether all IAM users have MFA enabled. When a new user is created without MFA, AWS Config can trigger an Amazon SNS notification via its compliance change event, meeting both the verification and notification requirements automatically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config continuously monitors the configuration of AWS resources and evaluates them against managed rules such as iam-user-mfa-enabled. This rule checks every IAM user's MFA status and reports any user without an assigned MFA device as non-compliant, allowing the security team to receive automated notifications via Amazon SNS or EventBridge. Additionally, AWS Config can be paired with Systems Manager Automation to auto-remediate non-compliant users, making it the correct service for verifying MFA across 200 IAM users.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records every API action taken in the account, such as EnableMFADevice or DeactivateMFADevice calls, creating an audit trail for investigators. However, it does not evaluate resource configurations against compliance policies or produce alerts about users currently missing MFA. To detect non-compliance with CloudTrail, you would have to build a separate system that analyzes the logs and cross-references IAM user states, which is not the purpose of the service.
When this WOULD be correct
A security team needs to audit all IAM user creation events and receive real-time alerts when a new user is created without MFA. CloudTrail can be used with CloudWatch Events to trigger a notification on the CreateUser API call, and then a custom Lambda function can check MFA status.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is an intelligent threat detection service that analyzes CloudTrail management events, VPC flow logs, and DNS logs for signs of malicious activity like compromised credentials or unauthorized access. It delivers findings about active threats, but it does not maintain a compliance inventory of IAM users or verify whether each user has MFA enabled. MFA configuration status is not part of GuardDuty's findings schema, so it cannot answer the security team's verification requirement.
When this WOULD be correct
A company needs to continuously monitor AWS accounts for suspicious API calls, such as unusual IAM user creation patterns or potential credential compromise, and receive alerts for security findings. GuardDuty would be the correct service to detect and notify about such threats.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor checks for security best practices, but its MFA check only covers the root account, not all IAM users. It also does not provide continuous evaluation or event-driven alerts for specific resource configuration changes.
When this WOULD be correct
A company wants a high-level assessment of their AWS account against best practices, including checking if MFA is enabled on the root account, and needs a summary report with recommendations. Trusted Advisor would be the correct service for this advisory check.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ConfigCorrect answer▾
Why this is correct
AWS Config continuously monitors the configuration of AWS resources and evaluates them against managed rules such as iam-user-mfa-enabled. This rule checks every IAM user's MFA status and reports any user without an assigned MFA device as non-compliant, allowing the security team to receive automated notifications via Amazon SNS or EventBridge. Additionally, AWS Config can be paired with Systems Manager Automation to auto-remediate non-compliant users, making it the correct service for verifying MFA across 200 IAM users.
✗AWS CloudTrailWrong answer — click to see why▾
Why this is wrong here
AWS CloudTrail records API activity but does not continuously evaluate resource configurations like MFA status or trigger notifications for non-compliant users.
★ When this WOULD be the correct answer
A security team needs to audit all IAM user creation events and receive real-time alerts when a new user is created without MFA. CloudTrail can be used with CloudWatch Events to trigger a notification on the CreateUser API call, and then a custom Lambda function can check MFA status.
Why candidates choose this
Candidates may think CloudTrail can monitor user creation events and trigger notifications, but they overlook that it does not natively evaluate MFA configuration compliance without additional custom logic.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for verifying IAM user MFA status or sending notifications about new users without MFA.
★ When this WOULD be the correct answer
A company needs to continuously monitor AWS accounts for suspicious API calls, such as unusual IAM user creation patterns or potential credential compromise, and receive alerts for security findings. GuardDuty would be the correct service to detect and notify about such threats.
Why candidates choose this
Candidates may confuse GuardDuty's monitoring and alerting capabilities with the compliance checking and notification requirements, assuming it can be used to track IAM user configurations.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides best-practice checks, including MFA on root account, but it does not automatically verify MFA for all IAM users or trigger notifications when a new user is created without MFA. It lacks the continuous compliance monitoring and custom rule enforcement needed for this requirement.
★ When this WOULD be the correct answer
A company wants a high-level assessment of their AWS account against best practices, including checking if MFA is enabled on the root account, and needs a summary report with recommendations. Trusted Advisor would be the correct service for this advisory check.
Why candidates choose this
Trusted Advisor includes a security check for MFA on the root account, leading candidates to assume it covers all IAM users. They overlook that it does not monitor per-user MFA status or provide event-driven notifications for new users.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.