CLF-C02 Security and Compliance Practice Question
A company manages multiple AWS accounts using AWS Organizations and maintains hundreds of Amazon S3 buckets across these accounts. The security team wants a service that automatically scans all S3 bucket policies and identifies any bucket that grants access to an external AWS account (an account outside the organization). The team needs to receive findings when such policies are detected and wants to review the findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse AWS Config's ability to monitor resource changes with the specific need to analyze policy content for external access, but Config requires custom Lambda rules or conformance packs to replicate what IAM Access Analyzer does natively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM Access Analyzer
AWS IAM Access Analyzer helps identify resources shared with external principals by analyzing resource-based policies (such as S3 bucket policies). It can be configured to use a trusted zone (e.g., the AWS Organizations management account or a specific OU) so that any policy granting access to an AWS account outside that zone generates a finding. These findings are aggregated in the IAM Access Analyzer console, providing a centralized dashboard for review.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor inspects AWS environments and provides best-practice recommendations in categories including cost, performance, security, and fault tolerance. It can check S3 bucket permissions for public access, but it does not specifically analyze policies for access granted to specific external AWS accounts, and it does not provide a continuous policy analysis dashboard for external access findings.
When this WOULD be correct
A company wants to review AWS account best practices, including S3 bucket public access checks, cost optimization, and service limits, all in one place. The security team needs a high-level overview of account health and recommendations.
- ✓
AWS IAM Access Analyzer
Why this is correct
IAM Access Analyzer analyzes resource-based policies across supported resources (including S3 buckets) and identifies when access is granted to an external entity, such as an AWS account outside the organization. It provides a centralized console to review findings and can send alerts via AWS Security Hub or Amazon EventBridge. This directly meets the requirement to automatically detect buckets accessible to external accounts.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates the configuration of AWS resources against desired rules and tracks configuration changes. While it can be used to detect changes to S3 bucket policies, it does not natively analyze whether a policy grants access to an external AWS account. Config is more about compliance with internal rules (e.g., 'require encryption') rather than detecting external access.
When this WOULD be correct
A company needs to continuously monitor S3 buckets for compliance with internal policies (e.g., requiring encryption or logging) and receive alerts when a bucket becomes non-compliant, with a centralized view of compliance status across accounts.
- ✗
AWS Service Catalog
Why it's wrong here
AWS Service Catalog helps organizations centrally manage approved IT service catalogs and allows users to launch only pre-approved resources. It does not have any capability to analyze existing S3 bucket policies for external access. This service is used for governance and provisioning, not for post-deployment policy analysis.
When this WOULD be correct
A company wants to standardize the creation of S3 buckets across multiple accounts by providing pre-approved bucket configurations (e.g., with specific encryption settings) that users can launch via a self-service portal. AWS Service Catalog would be the correct service to manage and deploy these standardized products.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS IAM Access AnalyzerCorrect answer▾
Why this is correct
IAM Access Analyzer analyzes resource-based policies across supported resources (including S3 buckets) and identifies when access is granted to an external entity, such as an AWS account outside the organization. It provides a centralized console to review findings and can send alerts via AWS Security Hub or Amazon EventBridge. This directly meets the requirement to automatically detect buckets accessible to external accounts.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor checks S3 bucket permissions for public access, but it does not specifically scan for access granted to external AWS accounts outside the organization. It also lacks a centralized dashboard for cross-account findings.
★ When this WOULD be the correct answer
A company wants to review AWS account best practices, including S3 bucket public access checks, cost optimization, and service limits, all in one place. The security team needs a high-level overview of account health and recommendations.
Why candidates choose this
Candidates may confuse Trusted Advisor's S3 bucket public access check with the requirement to detect external account access, or they may think Trusted Advisor provides a centralized dashboard for security findings.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config evaluates resource compliance against rules but does not automatically scan S3 bucket policies for access from external AWS accounts or provide a centralized dashboard for such findings.
★ When this WOULD be the correct answer
A company needs to continuously monitor S3 buckets for compliance with internal policies (e.g., requiring encryption or logging) and receive alerts when a bucket becomes non-compliant, with a centralized view of compliance status across accounts.
Why candidates choose this
Candidates may confuse AWS Config's ability to evaluate resource configurations with IAM Access Analyzer's purpose of analyzing resource-based policies for external access, especially since both can involve S3 buckets and compliance checks.
✗AWS Service CatalogWrong answer — click to see why▾
Why this is wrong here
AWS Service Catalog is used to create and manage IT service catalogs of approved AWS resources, not for analyzing S3 bucket policies for external access. It does not provide automated scanning or centralized findings for cross-account access.
★ When this WOULD be the correct answer
A company wants to standardize the creation of S3 buckets across multiple accounts by providing pre-approved bucket configurations (e.g., with specific encryption settings) that users can launch via a self-service portal. AWS Service Catalog would be the correct service to manage and deploy these standardized products.
Why candidates choose this
Candidates may confuse Service Catalog with a governance or compliance tool because it involves managing resources across accounts, but its purpose is provisioning and governance of approved templates, not security auditing.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.