CLF-C02 Security and Compliance Practice Question
A company manages over 100 AWS accounts using AWS Organizations. The security team wants a centralized service that continuously monitors for malicious or unauthorized behavior across all accounts. The service must analyze AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs to automatically detect threats such as anomalous API calls, crypto-mining activity, and compromised credentials. The security team wants to receive actionable alerts without having to write custom detection rules or manage underlying infrastructure. Which AWS service should the security team use?
⚠ Common exam trap
It's easy for candidates to confuse Amazon Inspector (a vulnerability scanner) with GuardDuty (a threat detector), or assume AWS Config can perform threat detection when it is actually a compliance and configuration tracking service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It natively analyzes AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs across all accounts in an AWS Organization, automatically generating actionable alerts without requiring custom rules or infrastructure management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector provides automated vulnerability assessments by scanning workloads such as EC2 instances and Lambda functions for software vulnerabilities and unintended network exposure. It operates on a snapshot or continuous scanning basis but only for resource packages and network configurations, not on the aggregate of CloudTrail, VPC Flow, and DNS logs, and it does not report findings like crypto-mining or compromised credentials from those log sources.
When this WOULD be correct
A company wants to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and network reachability issues, and needs to generate reports on findings without managing infrastructure.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is a static advisory engine that checks accounts against curated AWS best practices for cost optimization, performance, security, fault tolerance, and service quotas. It does not watch real-time telemetry like VPC Flow Logs or DNS logs and cannot detect active threats such as compromised API keys or malicious outbound traffic; its security checks are limited to configuration settings such as open S3 buckets or IAM key rotation.
When this WOULD be correct
A company wants a service that automatically checks AWS accounts for compliance with best practices (e.g., security groups open to unrestricted access, IAM key rotation) and provides recommendations to improve security posture without needing to deploy agents or analyze logs. Trusted Advisor would be the correct answer.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts and workloads for malicious activity. It analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to detect threats such as anomalous API calls, crypto-mining, and compromised credentials. It operates without requiring custom rules and can be centrally enabled across all accounts in an AWS Organization.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and lets you evaluate that history against compliance rules, but it does not ingest or analyze CloudTrail management events, VPC Flow Logs, or DNS queries. Its purpose is configuration compliance and change auditing, not scanning operational logs for anomalous or malicious activity; therefore it cannot fulfill the requirement described.
When this WOULD be correct
AWS Config would be correct in a scenario where the company needs to continuously monitor and evaluate AWS resource configurations for compliance with internal policies or industry standards, such as ensuring all S3 buckets are private or EC2 instances have required tags, and receive alerts on configuration changes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Amazon GuardDutyCorrect answer▾
Why this is correct
Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts and workloads for malicious activity. It analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to detect threats such as anomalous API calls, crypto-mining, and compromised credentials. It operates without requiring custom rules and can be centrally enabled across all accounts in an AWS Organization.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a threat detection service that analyzes CloudTrail, VPC Flow Logs, or DNS logs for malicious behavior.
★ When this WOULD be the correct answer
A company wants to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and network reachability issues, and needs to generate reports on findings without managing infrastructure.
Why candidates choose this
Candidates may confuse 'monitoring for threats' with 'vulnerability scanning,' and Inspector's name suggests it inspects for security issues, leading them to overlook that it does not analyze logs for threat detection.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides best-practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not continuously monitor for malicious activity or analyze CloudTrail, VPC Flow Logs, or DNS logs to detect threats like crypto-mining or compromised credentials.
★ When this WOULD be the correct answer
A company wants a service that automatically checks AWS accounts for compliance with best practices (e.g., security groups open to unrestricted access, IAM key rotation) and provides recommendations to improve security posture without needing to deploy agents or analyze logs. Trusted Advisor would be the correct answer.
Why candidates choose this
Candidates may confuse Trusted Advisor's security checks with threat detection, assuming that its security recommendations include real-time monitoring for malicious behavior, when in fact it only provides static checks and recommendations.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is a service for evaluating resource configurations against desired policies, not for threat detection. It does not analyze CloudTrail logs, VPC Flow Logs, or DNS logs to identify malicious activity.
★ When this WOULD be the correct answer
AWS Config would be correct in a scenario where the company needs to continuously monitor and evaluate AWS resource configurations for compliance with internal policies or industry standards, such as ensuring all S3 buckets are private or EC2 instances have required tags, and receive alerts on configuration changes.
Why candidates choose this
Candidates may confuse AWS Config's monitoring and alerting capabilities with security threat detection, as both involve continuous monitoring and rule-based evaluations, but Config focuses on configuration compliance, not threat analysis.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.