CLF-C02 Security and Compliance Practice Question
A company stores customer data in Amazon S3 buckets. The compliance team needs to automatically discover which buckets contain personally identifiable information (PII) such as names, addresses, and credit card numbers. The team also wants to receive continuous monitoring and alerts when new sensitive data is uploaded. Which AWS service should the team use to meet these requirements?
⚠ Common exam trap
Many exam-takers confuse Amazon Inspector (which scans for vulnerabilities) with Amazon Macie (which scans for sensitive data), because both involve 'scanning' but for entirely different purposes and resource types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Macie
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data in Amazon S3. It can identify PII such as names, addresses, and credit card numbers, and it provides continuous monitoring with alerts when new sensitive data is uploaded, meeting both the discovery and ongoing monitoring requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon Macie
Why this is correct
Amazon Macie is the correct answer because it is a fully managed data security and privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3, such as PII and financial information. It continuously monitors data access activity and generates alerts when anomalies or new sensitive objects are detected, giving security teams visibility into potential data exposure across the bucket estate.
- ✗
AWS Shield
Why it's wrong here
AWS Shield is a managed DDoS protection service that defends internet-facing applications against network and transport layer attacks, using traffic monitoring and mitigation at the AWS edge. Since it operates at the network and protocol levels, it does not have any capability to inspect object-level data within S3 buckets or classify sensitive content.
When this WOULD be correct
A company wants to protect its web applications from DDoS attacks and needs a managed service that provides always-on detection and automatic mitigations. AWS Shield (Standard or Advanced) would be the correct choice.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans Amazon EC2 instances and AWS Lambda functions for software vulnerabilities and unintended network exposure, not S3 objects. It performs agent-based or agentless assessments of operating systems and applications, so it cannot examine the contents of files stored in a bucket for personally identifiable information.
When this WOULD be correct
A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and network misconfigurations, and receive findings and alerts. Amazon Inspector would be the correct service.
- ✗
AWS Config
Why it's wrong here
AWS Config is a configuration and compliance auditing service that records and evaluates changes to AWS resource settings, such as S3 bucket policies, encryption, and public access blocks. It relies on rules that assess resource configurations, so it cannot read or scan the object payloads inside a bucket and therefore cannot identify PII or sensitive data stored there.
When this WOULD be correct
AWS Config would be correct if the question asked for tracking changes to S3 bucket policies or ensuring buckets are not publicly accessible, with alerts on configuration drift.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Amazon MacieCorrect answer▾
Why this is correct
Amazon Macie is the correct answer because it is a fully managed data security and privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3, such as PII and financial information. It continuously monitors data access activity and generates alerts when anomalies or new sensitive objects are detected, giving security teams visibility into potential data exposure across the bucket estate.
✗AWS ShieldWrong answer — click to see why▾
Why this is wrong here
AWS Shield is a managed DDoS protection service, not designed for data classification or PII discovery in S3 buckets.
★ When this WOULD be the correct answer
A company wants to protect its web applications from DDoS attacks and needs a managed service that provides always-on detection and automatic mitigations. AWS Shield (Standard or Advanced) would be the correct choice.
Why candidates choose this
Candidates may confuse 'protection' with 'data protection' and assume Shield covers sensitive data, or they may not be familiar with Macie's specific capabilities.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not for discovering PII in S3 buckets.
★ When this WOULD be the correct answer
A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and network misconfigurations, and receive findings and alerts. Amazon Inspector would be the correct service.
Why candidates choose this
Candidates may confuse 'inspecting' for sensitive data with vulnerability scanning, or think Inspector covers all types of data inspection due to its name.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is used to evaluate and record configuration changes of AWS resources, not to discover or monitor PII in S3 objects. It cannot inspect object content for sensitive data.
★ When this WOULD be the correct answer
AWS Config would be correct if the question asked for tracking changes to S3 bucket policies or ensuring buckets are not publicly accessible, with alerts on configuration drift.
Why candidates choose this
Candidates may confuse AWS Config's monitoring and alerting capabilities with data content inspection, thinking it can identify PII because it can monitor resource configurations.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.