CLF-C02 Security and Compliance Practice Question
A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?
⚠ Common exam trap
Many candidates confuse AWS Config (configuration auditing and compliance) with AWS Trusted Advisor (best-practice recommendations) or Amazon GuardDuty (threat detection), but only AWS Config can evaluate custom rules like tag and security group requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired rules. You can create a custom AWS Config rule to check that all EC2 instances have the tag 'Environment=Production' and are associated with the security group 'Prod-SG'. When a resource becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the IT team.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is a best-practice recommendation engine that reports on cost optimization, performance, fault tolerance, security, and service limits, but it only runs AWS-provided checks and cannot be customized to evaluate resources against your own compliance policies. For example, you cannot create a Trusted Advisor check that requires specific tags or a particular security group association, so it cannot enforce a company-specific policy. It provides generic recommendations, not continuous compliance auditing or custom rule evaluation.
When this WOULD be correct
A company wants to check its AWS account against AWS best practices (e.g., security, cost optimization) and receive recommendations for improvement, without needing to define custom compliance rules.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning to identify suspicious activity, such as unusual API calls or compromised credentials. It does not evaluate resource configurations for compliance with tagging or security group rules.
When this WOULD be correct
A company wants to continuously monitor its AWS account for suspicious API calls, potentially compromised EC2 instances, or reconnaissance activity from known malicious IP addresses. GuardDuty would be the correct service to detect such security threats.
- ✓
AWS Config
Why this is correct
AWS Config allows you to define rules (both managed and custom) that evaluate the configuration of your AWS resources. It continuously monitors for changes and can automatically detect resources that violate your policies, such as missing tags or incorrect security groups, and send notifications through Amazon SNS.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that performs network reachability and agent-based scans to identify software vulnerabilities (CVEs) and unintended network exposure on EC2 instances. It does not examine configuration metadata such as tags or the presence/association of security groups, and its checks are not designed to validate that resources meet your compliance requirements. Therefore, Inspector cannot detect whether an EC2 instance is missing a mandatory tag or is attached to an unapproved security group.
When this WOULD be correct
A company needs to automatically assess EC2 instances for known security vulnerabilities (e.g., CVEs) or deviations from security best practices like open ports to the internet. Amazon Inspector would be the correct service to perform these assessments and report findings.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ConfigCorrect answer▾
Why this is correct
AWS Config allows you to define rules (both managed and custom) that evaluate the configuration of your AWS resources. It continuously monitors for changes and can automatically detect resources that violate your policies, such as missing tags or incorrect security groups, and send notifications through Amazon SNS.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides best-practice recommendations but does not continuously monitor resource configurations against custom rules like tags or security group associations.
★ When this WOULD be the correct answer
A company wants to check its AWS account against AWS best practices (e.g., security, cost optimization) and receive recommendations for improvement, without needing to define custom compliance rules.
Why candidates choose this
Candidates may think Trusted Advisor can enforce custom compliance rules because it checks for best practices, but it only uses AWS-defined checks, not user-defined rules.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for compliance with tagging or security group rules.
★ When this WOULD be the correct answer
A company wants to continuously monitor its AWS account for suspicious API calls, potentially compromised EC2 instances, or reconnaissance activity from known malicious IP addresses. GuardDuty would be the correct service to detect such security threats.
Why candidates choose this
Candidates may confuse GuardDuty's monitoring capabilities with compliance monitoring, or assume that any security-related monitoring service can enforce tagging and security group rules.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for compliance with tagging or security group rules.
★ When this WOULD be the correct answer
A company needs to automatically assess EC2 instances for known security vulnerabilities (e.g., CVEs) or deviations from security best practices like open ports to the internet. Amazon Inspector would be the correct service to perform these assessments and report findings.
Why candidates choose this
Candidates may confuse Inspector's security assessment capabilities with compliance monitoring, assuming it can evaluate custom rules like tags and security group associations, but Inspector focuses on vulnerability scanning, not resource configuration compliance.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.