CLF-C02 AWS Config Practice Question
A company's security policy requires that all IAM user access keys be rotated every 90 days. The security team wants to automatically identify any IAM user in the company's AWS account whose access keys are older than 90 days and trigger a notification to the security team. They need a managed AWS service that continuously evaluates the access key age against this requirement and generates findings. Which AWS service should the security team use?
⚠ Common exam trap
Test-takers frequently confuse AWS Config's continuous compliance evaluation with AWS Trusted Advisor's one-time or periodic checks, or mistakenly think IAM Access Analyzer covers all IAM-related security checks, when it only focuses on external access analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is a managed service that continuously evaluates your AWS resource configurations against desired policies (e.g., access keys older than 90 days) using the managed rule 'access-keys-rotated'. It generates compliance findings and can trigger notifications via Amazon EventBridge or SNS, meeting the requirement for continuous evaluation and alerting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor includes a best practice check for IAM key rotation, but it is an advisory service that generates recommendations. It does not continuously enforce a specific rotation policy and does not automatically flag individual non-compliant keys for remediation or custom notifications in the same way AWS Config rules do.
When this WOULD be correct
A company wants a one-time review of its AWS account to identify IAM access keys older than 90 days and receive recommendations for remediation, without needing ongoing evaluation or custom rules. AWS Trusted Advisor's security checks can flag such keys in its dashboard.
- ✓
AWS Config
Why this is correct
AWS Config is a managed service that evaluates your AWS resource configurations against desired policies. The managed rule 'access-keys-rotated' continuously checks whether active IAM access keys have been rotated within the specified maximum age (e.g., 90 days). Non-compliant resources are identified, and you can configure Amazon SNS notifications to alert the security team. This meets the requirement for continuous evaluation and automated notification.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that performs automated security assessments on compute workloads such as Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions. It detects software vulnerabilities (CVEs) and unintended network exposure by analyzing the operating system and application packages, but it does not evaluate the configuration of IAM identities. Therefore, Inspector has no mechanism to check the age or rotation status of IAM user access keys and cannot enforce a policy requiring key rotation.
When this WOULD be correct
A company wants to automatically scan EC2 instances for missing security patches and unintended network access. Amazon Inspector would be the correct service to assess these vulnerabilities and generate findings.
- ✗
AWS IAM Access Analyzer
Why it's wrong here
AWS IAM Access Analyzer helps identify resources in your account that are shared with an external entity by analyzing resource-based policies (e.g., S3 bucket policies, IAM role trust policies). It does not evaluate the age or rotation status of IAM user access keys.
When this WOULD be correct
An exam question asking which AWS service can identify IAM roles or resources that are accessible from outside an AWS account (e.g., cross-account access) and generate findings about unintended public or cross-account access would have IAM Access Analyzer as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ConfigCorrect answer▾
Why this is correct
AWS Config is a managed service that evaluates your AWS resource configurations against desired policies. The managed rule 'access-keys-rotated' continuously checks whether active IAM access keys have been rotated within the specified maximum age (e.g., 90 days). Non-compliant resources are identified, and you can configure Amazon SNS notifications to alert the security team. This meets the requirement for continuous evaluation and automated notification.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides best practice checks and recommendations, but it does not continuously evaluate IAM user access key age against a custom 90-day policy and generate findings. It offers a limited set of predefined checks, not custom compliance rules.
★ When this WOULD be the correct answer
A company wants a one-time review of its AWS account to identify IAM access keys older than 90 days and receive recommendations for remediation, without needing ongoing evaluation or custom rules. AWS Trusted Advisor's security checks can flag such keys in its dashboard.
Why candidates choose this
Candidates may think Trusted Advisor covers all security best practices, including access key rotation, because it does check for expired or unused keys. However, it lacks the ability to enforce custom policies or provide continuous evaluation and automated notifications.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for evaluating IAM user access key age or compliance with rotation policies.
★ When this WOULD be the correct answer
A company wants to automatically scan EC2 instances for missing security patches and unintended network access. Amazon Inspector would be the correct service to assess these vulnerabilities and generate findings.
Why candidates choose this
Candidates may confuse 'Inspector' with a general compliance or auditing service, or mistakenly think it can inspect IAM credentials due to its name implying broad inspection capabilities.
✗AWS IAM Access AnalyzerWrong answer — click to see why▾
Why this is wrong here
AWS IAM Access Analyzer identifies resources shared with external entities, not the age of IAM user access keys. It does not evaluate access key rotation compliance.
★ When this WOULD be the correct answer
An exam question asking which AWS service can identify IAM roles or resources that are accessible from outside an AWS account (e.g., cross-account access) and generate findings about unintended public or cross-account access would have IAM Access Analyzer as the correct answer.
Why candidates choose this
The name 'Access Analyzer' suggests it analyzes access, and candidates may mistakenly think it covers all access-related checks, including key age, rather than focusing on external access analysis.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company's security policy requires that access keys for IAM users must be rotated every 90 days. Which AWS service can automatically detect users with non-compliant key age?
hard- A.AWS CloudTrail
- ✓ B.AWS Config with the access-keys-rotated rule
- C.Amazon GuardDuty
- D.AWS IAM Access Analyzer
Why B: AWS Config with the 'access-keys-rotated' managed rule automatically checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a key exceeds the configured maximum age, AWS Config flags the resource as non-compliant, enabling automated detection and remediation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.