CLF-C02 Security and Compliance Practice Question
A company's security team wants to continuously monitor their AWS environment for potential security threats such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior that might indicate a compromised resource. They need a managed threat detection service that uses machine learning to identify suspicious activity and generates detailed findings. The service should integrate with AWS Organizations to monitor multiple accounts and with Amazon CloudWatch Events to trigger automated responses. Which AWS service should the security team use?
⚠ Common exam trap
A common mix-up: candidates confuse a vulnerability scanning service (Inspector) or a configuration auditing service (Config) with a dedicated threat detection service that uses machine learning and threat intelligence to identify active threats like compromised credentials or malicious IP traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS environments for suspicious activity, such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior. It integrates natively with AWS Organizations to enable multi-account monitoring and with Amazon CloudWatch Events to trigger automated remediation workflows, directly matching all requirements in the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that assesses workloads for software vulnerabilities and unintended network exposure. It does not monitor API calls or detect compromised credentials, and it does not use threat intelligence feeds for known malicious IP addresses in the same way GuardDuty does.
When this WOULD be correct
A company needs to assess the security posture of EC2 instances by scanning for common vulnerabilities and deviations from security best practices, such as missing patches or open ports. The service should generate a report of findings with severity levels.
- ✗
AWS Config
Why it's wrong here
AWS Config is a resource inventory, configuration history, and compliance auditing service, not a threat detection service. It continuously records resource configuration changes and evaluates them against managed or custom rules (e.g., required tags, encryption settings) but it does not analyze AWS API call patterns or incorporate threat intelligence feeds. While AWS Config can alert on noncompliant resources, it cannot detect malicious activity such as compromised credentials, anomalous behavior, or known malicious IP addresses—that requires a service like GuardDuty that processes VPC Flow Logs, DNS logs, and CloudTrail management events.
When this WOULD be correct
A company needs to continuously monitor and evaluate the compliance of their AWS resource configurations against internal policies or industry standards, and receive alerts when resources become non-compliant.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is the correct service. It continuously monitors AWS accounts and workloads for malicious activity, using machine learning and integrated threat intelligence. It can monitor multiple accounts via AWS Organizations and send findings to CloudWatch Events for automated actions.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity in your account, providing an audit log. However, CloudTrail does not automatically analyze logs for threats or generate findings. To detect threats from CloudTrail logs, you need additional services like Amazon GuardDuty or Amazon Detective.
When this WOULD be correct
A company needs to audit all API activity in their AWS account for compliance and governance, and they require a service that records management events and data events for security analysis and troubleshooting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Amazon GuardDutyCorrect answer▾
Why this is correct
Amazon GuardDuty is the correct service. It continuously monitors AWS accounts and workloads for malicious activity, using machine learning and integrated threat intelligence. It can monitor multiple accounts via AWS Organizations and send findings to CloudWatch Events for automated actions.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a threat detection service that uses machine learning to identify suspicious API calls or anomalous behavior.
★ When this WOULD be the correct answer
A company needs to assess the security posture of EC2 instances by scanning for common vulnerabilities and deviations from security best practices, such as missing patches or open ports. The service should generate a report of findings with severity levels.
Why candidates choose this
Candidates may confuse vulnerability assessment with threat detection, assuming Inspector's security findings cover malicious activity like GuardDuty does.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is a service for evaluating resource configurations against desired policies, not for threat detection using machine learning or analyzing API calls for malicious activity.
★ When this WOULD be the correct answer
A company needs to continuously monitor and evaluate the compliance of their AWS resource configurations against internal policies or industry standards, and receive alerts when resources become non-compliant.
Why candidates choose this
Candidates may confuse AWS Config's monitoring and alerting capabilities with threat detection, or think that configuration compliance checks can identify security threats.
✗AWS CloudTrailWrong answer — click to see why▾
Why this is wrong here
AWS CloudTrail records API calls and user activity but does not use machine learning to detect threats or generate security findings; it is a logging service, not a threat detection service.
★ When this WOULD be the correct answer
A company needs to audit all API activity in their AWS account for compliance and governance, and they require a service that records management events and data events for security analysis and troubleshooting.
Why candidates choose this
Candidates may confuse CloudTrail's API logging with threat detection, thinking that analyzing logs alone can identify threats, but it lacks the ML-based anomaly detection and integrated threat intelligence that GuardDuty provides.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.