CLF-C02 Security and Compliance Practice Question

A company uses AWS Organizations and manages hundreds of AWS accounts. The security policy requires that all Amazon S3 buckets be encrypted using a specific AWS KMS customer-managed key (CMK). The security team wants to automatically detect any S3 bucket that is not encrypted with the required CMK and automatically apply the correct encryption configuration without manual intervention. Which AWS service should the security team use to implement this automated compliance enforcement?

⚠ Common exam trap

Watch out — candidates often confuse AWS Config's compliance evaluation and remediation capabilities with GuardDuty's threat detection or CloudTrail's audit logging, assuming any security-related service can enforce encryption policies.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Config

AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-kms-encryption-specific-key) that can evaluate whether S3 buckets are encrypted with the required KMS customer-managed key. When a noncompliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule to automatically apply the correct encryption configuration, enabling automated remediation without manual intervention.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior. It does not evaluate resource configuration compliance against internal policies or apply automatic remediation for noncompliant S3 bucket encryption settings.
When this WOULD be correct
If the question asked for a service to detect anomalous API activity or potential security threats, such as unusual S3 bucket access patterns or compromised credentials, GuardDuty would be the correct answer.
✓
AWS Config
Why this is correct
AWS Config is designed to assess, audit, and evaluate the configurations of AWS resources. It can detect S3 buckets that do not have the required encryption and trigger automatic remediation actions (e.g., using AWS Systems Manager Automation to enable server-side encryption with the designated KMS key). This satisfies both the detection and automatic correction requirements.
✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity across an AWS account for auditing, security analysis, and operational troubleshooting. While CloudTrail logs can show who created a bucket without encryption, it cannot automatically detect or remediate noncompliant bucket encryption configurations.
When this WOULD be correct
A question asking which service to use for auditing API calls to detect when S3 bucket encryption configurations are changed, without requiring automatic remediation, would make CloudTrail correct.
✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor inspects an AWS environment and provides best practice recommendations in categories such as cost, performance, security, and fault tolerance. It can alert users about S3 buckets with insecure configurations but does not provide automated remediation to enforce specific encryption settings.
When this WOULD be correct
A company wants to review its AWS environment for cost optimization, performance, security, and fault tolerance best practices. AWS Trusted Advisor would provide recommendations, such as identifying S3 buckets with low usage or without MFA delete, but without automatic remediation.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

✓AWS ConfigCorrect answer▾

Why this is correct

AWS Config is designed to assess, audit, and evaluate the configurations of AWS resources. It can detect S3 buckets that do not have the required encryption and trigger automatic remediation actions (e.g., using AWS Systems Manager Automation to enable server-side encryption with the designated KMS key). This satisfies both the detection and automatic correction requirements.

✗Amazon GuardDutyWrong answer — click to see why▾

Why this is wrong here

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a compliance enforcement tool. It cannot automatically detect or remediate S3 bucket encryption configurations.

★ When this WOULD be the correct answer

If the question asked for a service to detect anomalous API activity or potential security threats, such as unusual S3 bucket access patterns or compromised credentials, GuardDuty would be the correct answer.

Why candidates choose this

Candidates may confuse GuardDuty's security monitoring capabilities with compliance enforcement, assuming it can detect misconfigurations like missing encryption.

✗AWS CloudTrailWrong answer — click to see why▾

Why this is wrong here

AWS CloudTrail records API activity but cannot automatically remediate non-compliant S3 bucket encryption; it lacks the enforcement and auto-remediation capabilities required for this use case.

★ When this WOULD be the correct answer

A question asking which service to use for auditing API calls to detect when S3 bucket encryption configurations are changed, without requiring automatic remediation, would make CloudTrail correct.

Why candidates choose this

Candidates may confuse CloudTrail's logging of configuration changes with the ability to enforce or remediate those configurations, overlooking that it only provides audit trails, not automated compliance enforcement.

✗AWS Trusted AdvisorWrong answer — click to see why▾

Why this is wrong here

AWS Trusted Advisor provides best-practice recommendations but does not automatically enforce or remediate non-compliant resources. It cannot automatically apply encryption configuration to S3 buckets.

★ When this WOULD be the correct answer

A company wants to review its AWS environment for cost optimization, performance, security, and fault tolerance best practices. AWS Trusted Advisor would provide recommendations, such as identifying S3 buckets with low usage or without MFA delete, but without automatic remediation.

Why candidates choose this

Candidates may think Trusted Advisor can enforce security policies because it offers security checks, but they overlook that it only provides advisory recommendations, not automated enforcement.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CLF-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

AWS S3 Storage Class Comparison

Related to this question