CLF-C02 Security and Compliance Practice Question
A financial services company is preparing for an annual audit. The auditors have requested a copy of the AWS SOC 2 Type II report to verify the security controls of the AWS infrastructure that the company uses. The company's compliance officer needs to directly download this report from a trusted AWS source. Which AWS service should the compliance officer use to obtain the report?
⚠ Common exam trap
Watch out — candidates often confuse AWS Artifact with AWS Config or Amazon Inspector, mistakenly thinking that configuration auditing or vulnerability scanning tools can provide compliance reports, when only AWS Artifact is designed to serve as the authoritative source for AWS compliance documentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Artifact
AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 Type II reports, ISO certifications, and PCI DSS reports. The compliance officer can directly download the SOC 2 report from the AWS Artifact console or via the AWS Artifact API, ensuring the report comes from a trusted AWS source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config records AWS resource configuration changes and evaluates them against your custom or AWS-managed rules, allowing you to assess whether your resources align with internal policies or regulatory requirements. It excels at providing an inventory of your resource state and configuration history, but it does not publish or distribute AWS's own compliance certifications. The official SOC 2 Type II report, for example, is a pre-compiled audited document that must be obtained from AWS Artifact, not derived from your Config evaluator checks.
When this WOULD be correct
AWS Config would be correct if the question asked for a service that continuously monitors and records AWS resource configurations and evaluates them against desired policies for compliance auditing, such as checking whether security groups allow unrestricted access.
- ✓
AWS Artifact
Why this is correct
AWS Artifact is the correct service. It is the go-to place for on-demand access to AWS compliance reports (e.g., SOC, PCI) and agreements. You can download the SOC 2 Type II report directly from AWS Artifact.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor provides real-time recommendations across five categories: cost optimization, performance, security, fault tolerance, and service quotas, based on AWS Well-Architected best practices. It acts as a personalized cloud expert that inspects your environment, but it does not function as a compliance document portal. For annual audits, you need the actual signed compliance reports from AWS auditors, which Trusted Advisor cannot generate or download; those are available only from AWS Artifact.
When this WOULD be correct
A company wants to check its AWS account against AWS best practices for security and receive actionable recommendations to improve its security posture. In this scenario, AWS Trusted Advisor would be the correct service to use.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that continuously scans EC2 instances, container images, and Lambda functions for software vulnerabilities, unintended network exposure, and deviations from security best practices. While it helps you identify and remediate security issues in your own workloads, it does not grant access to AWS's third-party audit reports, such as SOC 2 or ISO 27001. Those compliance documents are published separately and are retrieved through AWS Artifact, not through Inspector's scan results.
When this WOULD be correct
A company needs to automatically assess its EC2 instances for vulnerabilities and deviations from security best practices. Amazon Inspector would be the correct service to run a security assessment and generate findings.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ArtifactCorrect answer▾
Why this is correct
AWS Artifact is the correct service. It is the go-to place for on-demand access to AWS compliance reports (e.g., SOC, PCI) and agreements. You can download the SOC 2 Type II report directly from AWS Artifact.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, but it does not provide access to AWS SOC reports. The SOC 2 Type II report is obtained via AWS Artifact.
★ When this WOULD be the correct answer
AWS Config would be correct if the question asked for a service that continuously monitors and records AWS resource configurations and evaluates them against desired policies for compliance auditing, such as checking whether security groups allow unrestricted access.
Why candidates choose this
Candidates may confuse 'compliance' and 'audit' with AWS Config's compliance evaluation features, mistakenly thinking it can provide audit reports like SOC reports.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide downloadable compliance reports like SOC reports.
★ When this WOULD be the correct answer
A company wants to check its AWS account against AWS best practices for security and receive actionable recommendations to improve its security posture. In this scenario, AWS Trusted Advisor would be the correct service to use.
Why candidates choose this
Candidates may confuse Trusted Advisor's security checks with compliance reporting, assuming it can generate or provide audit reports.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It does not provide access to AWS compliance reports like SOC 2 Type II.
★ When this WOULD be the correct answer
A company needs to automatically assess its EC2 instances for vulnerabilities and deviations from security best practices. Amazon Inspector would be the correct service to run a security assessment and generate findings.
Why candidates choose this
Candidates may confuse security assessment tools (Inspector) with compliance documentation services, assuming that any security-related AWS service can provide audit reports.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.