CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable AWS CloudTrail in each account individually and configure the S3 bucket to allow cross-account access from the audit account.

  Why it's wrong here

  Individually enabling CloudTrail in every member account and configuring each trail to deliver to a shared S3 bucket does not scale to AWS Organizations. This approach requires manual setup and ongoing maintenance per account, including cross-account S3 bucket policies, and it will silently miss newly created accounts unless you remember to enable CloudTrail in each one. An organization trail, by contrast, is created once in the management account and automatically captures API activity for every current and future member account, eliminating the operational overhead.

  When this WOULD be correct

  If the company does not use AWS Organizations or needs to enable CloudTrail only for a subset of accounts that are not part of an organization, enabling per-account trails with cross-account S3 access would be appropriate.

• ✓

  Create an AWS CloudTrail organization trail that logs events for all accounts in the organization.

  Why this is correct

  An organization trail is a single trail that logs API activity for all current and future member accounts in AWS Organizations, automatically delivering logs to a centralized S3 bucket. This meets the requirements with minimal ongoing manual effort.

• ✗

  Use AWS Config to record API calls and deliver configuration history to an S3 bucket.

  Why it's wrong here

  AWS Config is a service for recording and evaluating changes to resource configurations over time; it is not an API activity logger. While AWS Config can integrate with AWS CloudTrail to supply some event data for rule evaluation, its primary output is configuration history and configuration snapshots, not a complete audit of every API call made in the account. Relying on AWS Config would therefore leave you without a centralized, authoritative record of who called which API, when, and with what result.

  When this WOULD be correct

  A question asks: 'A company needs to track configuration changes to AWS resources across multiple accounts and automatically remediate noncompliant resources. Which service should be used?' In that case, AWS Config with multi-account aggregation would be correct.

• ✗

  Set up Amazon GuardDuty to monitor API activity and send findings to a centralized S3 bucket.

  Why it's wrong here

  Amazon GuardDuty is a threat detection service that continuously monitors for suspicious behavior using VPC Flow Logs, DNS logs, and CloudTrail management events to generate security findings. It does not store or export the full set of raw API calls to an S3 bucket, and its findings are curated security alerts rather than a complete, tamper-evident audit trail. GuardDuty complements CloudTrail, but it cannot replace it for compliance-oriented auditing of all API activity.

  When this WOULD be correct

  A company wants to detect and alert on suspicious API activity across multiple accounts, with findings centralized in an S3 bucket for analysis. GuardDuty would be the correct choice for threat detection, not for comprehensive audit logging.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question