CLF-C02 Security and Compliance Practice Question
A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a policy that restricts SSH access (port 22) from the internet (0.0.0.0/0) in all VPCs across all accounts. The team wants to centrally define the allowed rules and automatically apply them to newly created VPCs and security groups, while also automatically remediating any existing non-compliant security groups. Which AWS service should the team use?
⚠ Common exam trap
It's easy for candidates to confuse AWS Config's detection capabilities with enforcement, assuming it can automatically fix non-compliant resources without additional automation, while Firewall Manager is the native service for centralized, automated security group policy enforcement across an organization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Firewall Manager
AWS Firewall Manager is the correct service because it provides centralized management of firewall rules across all accounts in AWS Organizations. It can enforce a common security group rule to deny SSH access from 0.0.0.0/0, automatically apply this policy to new VPCs and security groups, and remediate non-compliant existing security groups by removing or replacing violating rules. This meets the requirement for both proactive enforcement and automated remediation at scale.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates resource configurations against desired policies and can detect non-compliant security groups. However, it does not provide centralized enforcement across multiple accounts or automatic remediation of the rules themselves. It is a detective control, not a preventive or centralized management service for security groups.
When this WOULD be correct
A company needs to continuously monitor and evaluate resource configurations for compliance with internal policies, such as checking that security groups do not allow SSH from 0.0.0.0/0, and trigger custom remediation actions via AWS Config rules and Lambda functions.
- ✓
AWS Firewall Manager
Why this is correct
AWS Firewall Manager is designed to centrally configure and manage firewall rules across accounts and resources in AWS Organizations. It can enforce a common security group policy, automatically apply it to new VPCs and security groups, and remediate existing non-compliant resources, meeting all the stated requirements.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a continuous security monitoring service that analyzes VPC Flow Logs, AWS CloudTrail event logs, and DNS query logs to detect threats like compromised instances or suspicious API activity. It is a detective control that only generates findings and alerts, and it has no capability to modify or enforce security group rules. Since it cannot proactively apply or remediate a common security group policy across accounts, it fails to meet the central enforcement requirement.
When this WOULD be correct
A company needs to continuously monitor VPC flow logs and detect suspicious network activity, such as port scanning or unusual traffic patterns, across multiple AWS accounts. GuardDuty would be the correct service to analyze logs and generate security findings.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
AWS Identity and Access Management (IAM) governs authentication and authorization for AWS API actions by defining what principals (users, roles, or federated identities) can do. IAM policies are identity-based or resource-based, but they do not interact with VPC-level constructs such as security groups, which are network firewalls that control traffic at the instance or ENI level. Therefore, IAM cannot be used to centrally configure or apply security group rules across multiple accounts in AWS Organizations, making it unsuitable for the stated requirement.
When this WOULD be correct
IAM would be correct if the question asked about controlling which users or roles can create, modify, or delete security groups, or if the requirement was to restrict API-level access to security group resources across accounts using IAM policies.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Firewall ManagerCorrect answer▾
Why this is correct
AWS Firewall Manager is designed to centrally configure and manage firewall rules across accounts and resources in AWS Organizations. It can enforce a common security group policy, automatically apply it to new VPCs and security groups, and remediate existing non-compliant resources, meeting all the stated requirements.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config can detect non-compliant security groups but cannot centrally enforce policies across all accounts or automatically remediate newly created VPCs and security groups. It lacks the ability to define and apply a common security policy across an organization.
★ When this WOULD be the correct answer
A company needs to continuously monitor and evaluate resource configurations for compliance with internal policies, such as checking that security groups do not allow SSH from 0.0.0.0/0, and trigger custom remediation actions via AWS Config rules and Lambda functions.
Why candidates choose this
Candidates may think AWS Config's compliance checks and auto-remediation features can centrally enforce policies, but they overlook that Config operates per account and region, requiring additional setup for multi-account enforcement.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a policy enforcement or remediation service. It cannot centrally define or automatically apply security group rules across accounts.
★ When this WOULD be the correct answer
A company needs to continuously monitor VPC flow logs and detect suspicious network activity, such as port scanning or unusual traffic patterns, across multiple AWS accounts. GuardDuty would be the correct service to analyze logs and generate security findings.
Why candidates choose this
Candidates may confuse GuardDuty's security monitoring capabilities with policy enforcement, assuming it can also block or remediate non-compliant configurations, when it only detects and alerts on threats.
✗AWS Identity and Access Management (IAM)Wrong answer — click to see why▾
Why this is wrong here
IAM is used to manage user permissions and access to AWS services, not to centrally enforce network security group rules across multiple accounts and VPCs. It cannot automatically remediate non-compliant security groups or apply policies to newly created VPCs.
★ When this WOULD be the correct answer
IAM would be correct if the question asked about controlling which users or roles can create, modify, or delete security groups, or if the requirement was to restrict API-level access to security group resources across accounts using IAM policies.
Why candidates choose this
Candidates may confuse IAM's ability to control permissions with the ability to enforce network security policies, thinking that IAM policies can directly restrict network traffic instead of just API actions.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.