CLF-C02 Security and Compliance Practice Question
A company uses AWS Organizations to manage over 50 AWS accounts. The security team has identified a high-priority requirement to prevent any security group rule in any account from allowing inbound RDP (port 3389) access from the internet (0.0.0.0/0). If a rule is created that violates this policy, the team wants it to be automatically removed. The team needs a centralized service that can enforce this policy across all current and new accounts without requiring manual setup in each account. Which AWS service should the team use?
⚠ Common exam trap
Watch out — candidates often confuse AWS Config's detection capabilities with Firewall Manager's enforcement capabilities, assuming Config can automatically remediate without realizing it requires custom automation, while Firewall Manager provides native, centralized auto-remediation across all accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Firewall Manager
AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across all accounts in an AWS Organization. It can enforce a security group policy that automatically removes any inbound RDP rule allowing 0.0.0.0/0, and it applies this policy to both existing and newly created accounts without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config can detect and evaluate security group rules against compliance rules, but it cannot automatically remediate non-compliant rules without additional custom automation (such as AWS Lambda or Systems Manager Automation). The question requires automatic removal without manual setup, so Config alone is insufficient.
When this WOULD be correct
A company needs to continuously monitor and evaluate resource configurations for compliance with internal policies, such as detecting security group rules that allow SSH access from the internet, and receive alerts via Amazon SNS. The team is willing to manually fix violations or use separate automation.
- ✓
AWS Firewall Manager
Why this is correct
AWS Firewall Manager allows organizations to centrally configure and manage security group rules and AWS WAF rules across all accounts. It can apply a common security group baseline and automatically remove non-compliant rules (e.g., inbound RDP from 0.0.0.0/0), enforcing the policy across current and new accounts without manual intervention.
- ✗
AWS IAM Access Analyzer
Why it's wrong here
AWS IAM Access Analyzer helps identify resources that are shared with an external entity by analyzing resource-based policies (like S3 bucket policies). It does not address security group rules or automatic remediation, so it is not relevant to this requirement.
When this WOULD be correct
An exam question where the requirement is to identify overly permissive resource-based policies (e.g., S3 bucket policies, IAM roles) that grant access to external AWS accounts or principals, and the team needs a tool to generate findings for review.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub aggregates security findings from multiple AWS services, including AWS Config, and provides a centralized view of compliance status. However, it does not enforce policies or automatically remediate non-compliant resources. It only reports on findings.
When this WOULD be correct
A company wants a centralized dashboard to aggregate and prioritize security findings (e.g., from AWS Config, Amazon GuardDuty, and AWS IAM Access Analyzer) across multiple accounts, and needs to view compliance status against security standards like CIS or PCI DSS. Security Hub would be the correct service for this multi-account security visibility and alerting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Firewall ManagerCorrect answer▾
Why this is correct
AWS Firewall Manager allows organizations to centrally configure and manage security group rules and AWS WAF rules across all accounts. It can apply a common security group baseline and automatically remove non-compliant rules (e.g., inbound RDP from 0.0.0.0/0), enforcing the policy across current and new accounts without manual intervention.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config can detect noncompliant security group rules but cannot automatically remediate them without additional custom automation (e.g., AWS Config rules with auto-remediation via Systems Manager Automation). The question requires automatic removal, which Config alone does not provide.
★ When this WOULD be the correct answer
A company needs to continuously monitor and evaluate resource configurations for compliance with internal policies, such as detecting security group rules that allow SSH access from the internet, and receive alerts via Amazon SNS. The team is willing to manually fix violations or use separate automation.
Why candidates choose this
Candidates may think AWS Config can enforce policies because it has managed rules for security group compliance, but they overlook that Config only evaluates and reports, not automatically remediates, unless explicitly configured with custom remediation actions.
✗AWS IAM Access AnalyzerWrong answer — click to see why▾
Why this is wrong here
AWS IAM Access Analyzer analyzes resource-based policies to identify resources shared with external entities, but it does not enforce or automatically remediate security group rules. It cannot prevent or remove inbound RDP rules from 0.0.0.0/0.
★ When this WOULD be the correct answer
An exam question where the requirement is to identify overly permissive resource-based policies (e.g., S3 bucket policies, IAM roles) that grant access to external AWS accounts or principals, and the team needs a tool to generate findings for review.
Why candidates choose this
Candidates may confuse 'access analyzer' with a tool that analyzes security group rules for overly permissive access, or mistakenly think it can enforce policies across accounts.
✗AWS Security HubWrong answer — click to see why▾
Why this is wrong here
AWS Security Hub provides a comprehensive view of security alerts and compliance status across accounts, but it does not have the capability to automatically remediate or remove non-compliant security group rules. It can detect violations but relies on other services like AWS Config or AWS Firewall Manager for enforcement.
★ When this WOULD be the correct answer
A company wants a centralized dashboard to aggregate and prioritize security findings (e.g., from AWS Config, Amazon GuardDuty, and AWS IAM Access Analyzer) across multiple accounts, and needs to view compliance status against security standards like CIS or PCI DSS. Security Hub would be the correct service for this multi-account security visibility and alerting.
Why candidates choose this
Candidates may confuse Security Hub's ability to aggregate security findings and check compliance with the ability to enforce and remediate policies automatically. They might think Security Hub can directly remove non-compliant rules because it integrates with AWS Config rules, but remediation requires additional configuration.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.