CLF-C02 Security and Compliance Practice Question
A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce a policy that prevents any user or role in any member account from disabling AWS CloudTrail or deleting CloudTrail log files from Amazon S3. The team needs a solution that is centrally managed from the management account and applies to all current and future member accounts automatically. Which AWS feature should the security team use to meet these requirements?
⚠ Common exam trap
Candidates often confuse SCPs with IAM permissions boundaries, not realizing that SCPs operate at the organization level and apply to all accounts automatically, while permissions boundaries are account-specific and require manual configuration per user/role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service Control Policies (SCPs)
Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts within an organization. By attaching an SCP that explicitly denies the actions to disable CloudTrail or delete CloudTrail log files from S3, the security team can enforce this policy across all current and future member accounts from the management account, as SCPs automatically apply to new accounts added to the organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config conformance packs
Why it's wrong here
AWS Config conformance packs are collections of AWS Config rules and remediation actions that evaluate resource compliance. While they can detect non-compliant resources (e.g., CloudTrail being disabled), they do not proactively prevent a user from performing the disabling action. They are detective, not preventive, and require additional automation to enforce. Thus, they are not the primary feature for centrally preventing actions across all accounts.
When this WOULD be correct
A company needs to continuously monitor that CloudTrail trails are enabled and S3 bucket policies are correctly configured across all accounts, with automated remediation for noncompliant resources.
- ✓
Service Control Policies (SCPs)
Why this is correct
Correct. SCPs are the correct choice because they allow centralized control over the maximum permissions for all accounts in an AWS Organization. They can explicitly deny actions such as disabling CloudTrail or deleting S3 objects in the log bucket. SCPs apply across the entire organization, including new accounts, and cannot be overridden by member account administrators. This provides the preventive enforcement the security team requires.
- ✗
IAM permissions boundaries
Why it's wrong here
IAM permissions boundaries are used to set the maximum permissions that an IAM entity (user or role) can have, but they are applied at the individual account level. They cannot be centrally managed from the management account across all member accounts. Additionally, they do not restrict actions of the root user or other entities if the boundary is not attached. Therefore, they do not meet the requirement for centralized, organization-wide prevention.
When this WOULD be correct
A question where the requirement is to limit the permissions of a specific IAM role or user within a single account, such as preventing a developer role from creating or deleting EC2 instances, while allowing other actions.
- ✗
AWS CloudTrail data events
Why it's wrong here
AWS CloudTrail data events record object-level operations (e.g., GetObject, DeleteObject) on S3 buckets. They are a logging feature, not a control mechanism. Enabling data events does not prevent anyone from disabling CloudTrail or deleting log files; it only provides a record of those actions after they occur. Thus, it does not enforce the desired restrictions.
When this WOULD be correct
A company needs to audit all S3 object-level operations (e.g., GET, PUT, DELETE) for compliance. The security team wants to capture these operations for analysis. In this scenario, enabling CloudTrail data events on the S3 buckets would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Service Control Policies (SCPs)Correct answer▾
Why this is correct
Correct. SCPs are the correct choice because they allow centralized control over the maximum permissions for all accounts in an AWS Organization. They can explicitly deny actions such as disabling CloudTrail or deleting S3 objects in the log bucket. SCPs apply across the entire organization, including new accounts, and cannot be overridden by member account administrators. This provides the preventive enforcement the security team requires.
✗AWS Config conformance packsWrong answer — click to see why▾
Why this is wrong here
AWS Config conformance packs evaluate resource compliance against rules but do not enforce preventive controls to block actions like disabling CloudTrail or deleting S3 logs across all accounts.
★ When this WOULD be the correct answer
A company needs to continuously monitor that CloudTrail trails are enabled and S3 bucket policies are correctly configured across all accounts, with automated remediation for noncompliant resources.
Why candidates choose this
Candidates may confuse detective compliance checks (Config) with preventive policy enforcement (SCPs), especially when the requirement involves 'enforcing a policy' across multiple accounts.
✗IAM permissions boundariesWrong answer — click to see why▾
Why this is wrong here
IAM permissions boundaries only restrict the maximum permissions for IAM users or roles within a single account, not across all accounts in an organization, and they do not automatically apply to future accounts.
★ When this WOULD be the correct answer
A question where the requirement is to limit the permissions of a specific IAM role or user within a single account, such as preventing a developer role from creating or deleting EC2 instances, while allowing other actions.
Why candidates choose this
Candidates may confuse permissions boundaries with SCPs because both are used to set permission limits, but they operate at different scopes (account vs. organization).
✗AWS CloudTrail data eventsWrong answer — click to see why▾
Why this is wrong here
CloudTrail data events log resource operations within AWS services (e.g., S3 object-level actions), but they do not provide any mechanism to enforce policies or prevent actions like disabling CloudTrail or deleting log files. They are a logging feature, not a governance or prevention tool.
★ When this WOULD be the correct answer
A company needs to audit all S3 object-level operations (e.g., GET, PUT, DELETE) for compliance. The security team wants to capture these operations for analysis. In this scenario, enabling CloudTrail data events on the S3 buckets would be the correct answer.
Why candidates choose this
Candidates may confuse data events with management events or think that logging data events can somehow prevent actions, not realizing that CloudTrail is purely for auditing and cannot enforce policies.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.