CLF-C02 Security and Compliance Practice Question
A company's security team wants to identify all Amazon S3 buckets that are shared with external AWS accounts or publicly accessible. The team needs a continuous evaluation that reports findings in a centralized dashboard and sends alerts when new unintended external shares are created. Which AWS service should the security team use to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse AWS Config's ability to detect resource changes with the specific need for continuous policy analysis and centralized findings for external access, leading them to pick AWS Config instead of IAM Access Analyzer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAM Access Analyzer
IAM Access Analyzer is the correct choice because it continuously monitors resource policies, including S3 bucket policies, to identify resources shared with external AWS accounts or publicly. It provides a centralized dashboard in the IAM console to view findings and integrates with Amazon EventBridge to send alerts via Amazon SNS when new unintended external shares are created, meeting all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is used to evaluate your resource configurations against desired rules (e.g., whether S3 bucket server-side encryption is enabled). While AWS Config can check if an S3 bucket has a public access block, it is not the primary service for identifying resources shared with external AWS accounts. IAM Access Analyzer is purpose-built for this.
When this WOULD be correct
A company needs to continuously monitor AWS resource configurations for compliance with internal policies (e.g., requiring encryption on S3 buckets) and receive alerts when resources become non-compliant. AWS Config rules and its dashboard would be the correct service for this scenario.
- ✓
IAM Access Analyzer
Why this is correct
IAM Access Analyzer analyzes resource-based policies to identify resources that are shared with external entities (outside your AWS organization). It provides continuous monitoring, a dashboard of findings, and integration with AWS Security Hub and Amazon EventBridge for alerts. This directly meets the requirement.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor inspects your AWS environment and provides best practice recommendations, including a check for S3 bucket permissions that allow public access. However, Trusted Advisor's checks are performed periodically (not continuously), and it does not provide a centralized dashboard for ongoing findings or alerting on new external shares beyond public access. IAM Access Analyzer is more comprehensive for this specific use case.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior in your AWS environment. It does not analyze S3 bucket policies for external sharing. GuardDuty can detect suspicious API calls or potential credential compromise, but it is not designed to identify resources shared with external accounts.
When this WOULD be correct
A company wants to continuously monitor AWS accounts for malicious or unauthorized activity, such as compromised credentials, API calls from unusual locations, or potential cryptocurrency mining. GuardDuty would be the correct service to detect these threats and send alerts.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓IAM Access AnalyzerCorrect answer▾
Why this is correct
IAM Access Analyzer analyzes resource-based policies to identify resources that are shared with external entities (outside your AWS organization). It provides continuous monitoring, a dashboard of findings, and integration with AWS Security Hub and Amazon EventBridge for alerts. This directly meets the requirement.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config can evaluate resource compliance against rules but does not natively identify S3 buckets shared with external accounts or provide a centralized dashboard for such findings; it lacks the specific external access analysis that IAM Access Analyzer offers.
★ When this WOULD be the correct answer
A company needs to continuously monitor AWS resource configurations for compliance with internal policies (e.g., requiring encryption on S3 buckets) and receive alerts when resources become non-compliant. AWS Config rules and its dashboard would be the correct service for this scenario.
Why candidates choose this
Candidates may confuse AWS Config's ability to track configuration changes and evaluate rules with the specific need to detect external access to S3 buckets, assuming Config's compliance checks cover all security scenarios.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for identifying S3 buckets shared with external accounts or publicly accessible. It does not provide a centralized dashboard for external sharing findings or continuous evaluation of bucket policies.
★ When this WOULD be the correct answer
A company wants to continuously monitor AWS accounts for malicious or unauthorized activity, such as compromised credentials, API calls from unusual locations, or potential cryptocurrency mining. GuardDuty would be the correct service to detect these threats and send alerts.
Why candidates choose this
Candidates may confuse GuardDuty's security monitoring capabilities with the specific need to audit S3 bucket permissions, assuming it covers all security-related findings including access control misconfigurations.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.