CLF-C02 AWS Config Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Config with a managed rule to check for unrestricted SSH access, and Amazon Simple Notification Service (Amazon SNS) to send notifications when the rule is non-compliant.

  Why this is correct

  AWS Config can evaluate security group rules against a managed rule like 'restricted-ssh' (or a custom rule) and trigger an SNS notification when a resource is non-compliant. CloudTrail logs the API calls that made the change, and AWS Config can include the related CloudTrail event in its compliance history.

• ✗

  AWS CloudTrail to log all API calls, and Amazon CloudWatch Logs to analyze the logs for security group modifications and trigger a notification.

  Why it's wrong here

  This option is tempting because CloudTrail correctly logs API calls, including the user, and CloudWatch Logs can analyse these for specific patterns and trigger notifications, fulfilling parts of the requirement for change records and alerts. However, it fails to provide a direct, purpose-built mechanism for *continuously evaluating the configuration state* of security groups against a specific compliance rule (inbound SSH from 0.0.0.0/0). Setting up complex CloudWatch Logs filters to parse ingress rules from API call events for compliance checks is cumbersome and not the intended use for ongoing configuration compliance monitoring.

  When this WOULD be correct

  This combination would be correct if the requirement was to audit all API calls for security group modifications and trigger notifications based on specific API events (e.g., AuthorizeSecurityGroupIngress) using CloudWatch Events, rather than continuously evaluating the configuration state.

• ✗

  AWS Trusted Advisor to check for security groups with unrestricted SSH access on a periodic basis, and Amazon Simple Email Service (Amazon SES) to send email alerts.

  Why it's wrong here

  AWS Trusted Advisor checks for best practices but runs periodically (e.g., every 24 hours), not in real time. It cannot trigger immediate notifications based on configuration changes. It also does not provide a detailed record of who made the change.

• ✗

  AWS Systems Manager Inventory to collect configuration data from EC2 instances, and Amazon CloudWatch Events to trigger a Lambda function that checks security group rules.

  Why it's wrong here

  AWS Systems Manager Inventory is designed to collect software inventory and OS configuration from EC2 instances, not to capture security group rule definitions. Therefore, the described solution cannot evaluate inbound SSH access restrictions because the necessary security group data would never be in the inventory. While Amazon CloudWatch Events could schedule or trigger a Lambda function, this approach still lacks a purpose-built mechanism for continuous compliance monitoring and would require custom code to query the EC2 API, making it inferior to AWS Config's managed rules.

  When this WOULD be correct

  A company needs to continuously collect software inventory and patch compliance data from EC2 instances, and automatically remediate non-compliant instances by running a Systems Manager Automation document via CloudWatch Events.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question