CLF-C02 Security and Compliance Practice Question
A company has 50 IAM users in a single AWS account. The security policy requires that every IAM user must have a virtual MFA device enabled for AWS Management Console access. The company wants to automatically detect any user who disables or has an inactive MFA device and immediately revoke that user's ability to access AWS resources by disabling their access keys. The solution must be fully managed, require no custom scripts, and use native AWS services. Which AWS service should the company use to define the compliance rule and automatically trigger the remediation action?
⚠ Common exam trap
A common mix-up: candidates confuse AWS CloudTrail's logging and monitoring capabilities with AWS Config's compliance evaluation and remediation features, mistakenly thinking that CloudTrail can automatically enforce security policies when it only records events for analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it provides managed rules (such as the `iam-user-mfa-enabled` managed rule) that continuously evaluate IAM user configurations against compliance policies. When a user disables or has an inactive virtual MFA device, AWS Config can detect the non-compliant resource and automatically trigger a remediation action via AWS Systems Manager Automation, which can disable the user's access keys without any custom scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config offers managed rules like 'iam-user-mfa-enabled' to check MFA compliance. It can automatically trigger a remediation action (e.g., disabling access keys) when a noncompliant user is detected, meeting the requirement for a fully managed solution without custom scripts.
- ✗
AWS Shield
Why it's wrong here
AWS Shield is a managed DDoS protection service that defends applications against network and transport layer attacks, such as UDP floods and reflection attacks. It operates at the edge of the AWS network and, even with Shield Advanced, integrates with AWS WAF for application-layer protection—never with IAM. Shield has no visibility into IAM user configurations, MFA device status, or identity policies, and it cannot evaluate compliance rules or trigger remediation actions like disabling access keys. Therefore, it is entirely unrelated to enforcing MFA compliance across IAM users.
When this WOULD be correct
A company wants to protect its AWS resources from DDoS attacks, especially against web applications, and needs a managed service that provides automatic detection and mitigation. AWS Shield (Standard or Advanced) would be the correct answer.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is an auditing service that records API calls made in your AWS account, producing a detailed event history for governance, compliance, and operational troubleshooting. While CloudTrail logs may include information about whether an MFA-authenticated call was made, it does not assess the current configuration state of resources against compliance rules, nor does it have any mechanism to automatically remediate noncompliant resources. CloudTrail is a passive log collector and cannot disable access keys, modify IAM policies, or enforce MFA settings. Thus it fails the requirement for automated compliance checking and remediation.
When this WOULD be correct
A company needs to audit all API calls made in their AWS account, including who made them, when, and from which IP address, to meet compliance requirements. AWS CloudTrail would be the correct service to enable governance, compliance, and operational auditing.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that filters and monitors HTTP/HTTPS traffic destined for your web applications, using rules to block attacks like SQL injection, cross-site scripting, and oversized requests. It operates exclusively at the application layer of network traffic and has no ability to read or modify IAM user attributes, such as MFA device registration or access key status. WAF does not evaluate AWS resource configurations and cannot trigger remediation actions on IAM resources. Consequently, it cannot enforce IAM user MFA policies and is not a candidate for this use case.
When this WOULD be correct
A company wants to automatically block malicious IP addresses from accessing their Application Load Balancer based on a rule that detects SQL injection attacks. AWS WAF would be the correct service to define the web ACL and trigger the block action.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ConfigCorrect answer▾
Why this is correct
AWS Config offers managed rules like 'iam-user-mfa-enabled' to check MFA compliance. It can automatically trigger a remediation action (e.g., disabling access keys) when a noncompliant user is detected, meeting the requirement for a fully managed solution without custom scripts.
✗AWS ShieldWrong answer — click to see why▾
Why this is wrong here
AWS Shield is a managed DDoS protection service, not a compliance or configuration management service. It cannot define rules for MFA compliance or trigger remediation actions like disabling access keys.
★ When this WOULD be the correct answer
A company wants to protect its AWS resources from DDoS attacks, especially against web applications, and needs a managed service that provides automatic detection and mitigation. AWS Shield (Standard or Advanced) would be the correct answer.
Why candidates choose this
Candidates may confuse 'Shield' with a security service that enforces policies, or they might think it provides general security monitoring, but it is specifically for DDoS protection.
✗AWS CloudTrailWrong answer — click to see why▾
Why this is wrong here
AWS CloudTrail records API activity but does not evaluate compliance rules or trigger automated remediation actions. It cannot detect inactive MFA devices or disable access keys on its own.
★ When this WOULD be the correct answer
A company needs to audit all API calls made in their AWS account, including who made them, when, and from which IP address, to meet compliance requirements. AWS CloudTrail would be the correct service to enable governance, compliance, and operational auditing.
Why candidates choose this
Candidates may think CloudTrail can detect security violations because it logs user activity, but they overlook that it lacks native rule evaluation and remediation capabilities.
✗AWS WAFWrong answer — click to see why▾
Why this is wrong here
AWS WAF is a web application firewall that protects web applications from common web exploits; it does not monitor IAM user configurations or enforce compliance rules for MFA devices.
★ When this WOULD be the correct answer
A company wants to automatically block malicious IP addresses from accessing their Application Load Balancer based on a rule that detects SQL injection attacks. AWS WAF would be the correct service to define the web ACL and trigger the block action.
Why candidates choose this
Candidates may confuse 'security policy' and 'remediation action' with a firewall service, mistakenly thinking WAF can enforce IAM user compliance because it deals with security rules.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.