CLF-C02 Security and Compliance Practice Question
A company's external auditor requires the company to provide evidence that the AWS infrastructure used by the company meets SOC 2 and ISO 27001 standards. The company needs to download the latest AWS SOC 2 report and ISO 27001 certification to share with the auditor. Which AWS service or feature should the company use to retrieve these documents?
⚠ Common exam trap
Many candidates confuse AWS Artifact (a document repository for compliance reports) with AWS Audit Manager (a tool for automating internal audits), leading them to select Audit Manager when the question specifically asks for downloading existing reports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Artifact
AWS Artifact is the correct service because it provides on-demand access to AWS security and compliance reports, including SOC 2 and ISO 27001 certifications. The company can download the latest versions directly from the AWS Artifact console or API, satisfying the auditor's request for evidence without needing to configure any additional resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Audit Manager
Why it's wrong here
AWS Audit Manager helps you automate evidence collection and build audit reports for internal compliance frameworks like HIPAA or GDPR. It gathers and organizes activity from your own AWS account to support your audits, but it does not provide AWS's own attestations or certifications. The service facilitates your audit process; it does not act as the auditor or issuer of AWS's compliance documents.
When this WOULD be correct
A company needs to continuously monitor and collect evidence of its own AWS resource configurations against SOC 2 or ISO 27001 controls, and automate audit report generation. AWS Audit Manager would be the correct service to use.
- ✓
AWS Artifact
Why this is correct
AWS Artifact is the only service that provides on-demand access to AWS's own compliance reports and agreements. It hosts downloadable artifacts such as SOC 1/2/3 reports, ISO 27001/9001 certifications, PCI DSS reports, and HIPAA attestations, exactly matching an external auditor's request for AWS compliance evidence. No other AWS service serves as the central repository for these certifications.
- ✗
AWS Config
Why it's wrong here
AWS Config is a fully managed service that records and evaluates resource configurations against desired policies and rules. It can generate configuration history and compliance snapshots for your own resources, but it cannot produce AWS's independent, third-party audited compliance certifications. Its compliance data is evidence about your account's resource state, not about AWS's corporate controls.
When this WOULD be correct
A company needs to continuously monitor and evaluate the configuration of its AWS resources against internal policies or specific compliance frameworks (e.g., PCI DSS, HIPAA) and receive automated compliance score. AWS Config rules and aggregators would be the correct service.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is an analysis tool that inspects your environment and provides best-practice recommendations across cost optimization, performance, security, and fault tolerance. While it can flag issues like open security groups or unused resources, it does not serve as a compliance document repository and has no capability to generate or download formal audit reports such as SOC 2. Its checks are advisory and real-time, not certifying.
When this WOULD be correct
A question asking which AWS service provides real-time guidance to provision resources following AWS best practices, such as checking for unused resources or security group rules that allow unrestricted access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ArtifactCorrect answer▾
Why this is correct
AWS Artifact is the only service that provides on-demand access to AWS's own compliance reports and agreements. It hosts downloadable artifacts such as SOC 1/2/3 reports, ISO 27001/9001 certifications, PCI DSS reports, and HIPAA attestations, exactly matching an external auditor's request for AWS compliance evidence. No other AWS service serves as the central repository for these certifications.
✗AWS Audit ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Audit Manager helps audit AWS resource usage by creating evidence and reports, but it does not provide pre-existing compliance reports like SOC 2 or ISO 27001; those are available only through AWS Artifact.
★ When this WOULD be the correct answer
A company needs to continuously monitor and collect evidence of its own AWS resource configurations against SOC 2 or ISO 27001 controls, and automate audit report generation. AWS Audit Manager would be the correct service to use.
Why candidates choose this
Candidates may confuse 'audit' in the service name with the need for compliance reports, not realizing Audit Manager is for internal audits, not for downloading AWS's own certifications.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, but it does not provide downloadable SOC 2 or ISO 27001 reports. Those reports are accessed via AWS Artifact.
★ When this WOULD be the correct answer
A company needs to continuously monitor and evaluate the configuration of its AWS resources against internal policies or specific compliance frameworks (e.g., PCI DSS, HIPAA) and receive automated compliance score. AWS Config rules and aggregators would be the correct service.
Why candidates choose this
Candidates may confuse 'compliance' in the question with AWS Config's compliance features, not realizing that AWS Config monitors resource configurations, not provides third-party audit reports.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but does not provide downloadable compliance reports like SOC 2 or ISO 27001 certifications.
★ When this WOULD be the correct answer
A question asking which AWS service provides real-time guidance to provision resources following AWS best practices, such as checking for unused resources or security group rules that allow unrestricted access.
Why candidates choose this
Candidates may confuse Trusted Advisor's security checks with compliance reporting, assuming it can generate evidence for audits.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.