CLF-C02 Security and Compliance Practice Question
A financial services company is preparing for an annual third-party audit. The auditor has requested a copy of the AWS SOC 2 Type II report to evaluate the security controls of the AWS infrastructure. The company needs to retrieve the report as quickly as possible without raising a support ticket. Which AWS service should they use?
⚠ Common exam trap
Many exam-takers confuse AWS Artifact with AWS Security Hub or AWS Config, thinking those services provide compliance reports, when in fact AWS Artifact is the only service that directly serves downloadable audit documentation without requiring a support ticket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Artifact
AWS Artifact is the correct service because it provides on-demand, self-service access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications, without needing to open a support ticket. The auditor's request for a SOC 2 Type II report is exactly the use case AWS Artifact is designed for, allowing the company to download the report immediately from the AWS Management Console or via the AWS CLI.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub aggregates security findings from multiple AWS services and performs continuous automated checks against standards like the CIS AWS Foundations Benchmark, providing a consolidated security score. However, it does not issue or download formal compliance attestations; it only surfaces operational security alerts and postural insights. For obtaining SOC or PCI reports, you would still need AWS Artifact, making Security Hub an incorrect choice for this scenario.
When this WOULD be correct
A company needs to centrally view and manage security findings from multiple AWS services and automate compliance checks against standards like CIS AWS Foundations. AWS Security Hub would be the correct service to aggregate and prioritize security alerts.
- ✗
AWS Config
Why it's wrong here
AWS Config records and evaluates configuration changes to your AWS resources against custom or managed rules, enabling you to track compliance with your own internal policies. While its compliance history can support audit preparation, it does not grant access to AWS's independent third-party certifications such as SOC 2 or ISO 27001, which are exactly what a financial services company needs for its annual review. Thus, Config is useful for governance but not for retrieving official compliance documents.
When this WOULD be correct
AWS Config would be correct if the question asked: 'Which service can be used to continuously monitor and record AWS resource configurations and evaluate them against desired configurations for compliance auditing?'
- ✓
AWS Artifact
Why this is correct
AWS Artifact is the designated service for obtaining compliance documentation directly from AWS, offering on-demand access to SOC, PCI, and ISO reports along with agreements such as HIPAA BAA. These reports can be downloaded from the AWS Management Console or programmatically via the AWS Artifact API, making it the appropriate choice for an annual compliance review. Its role is to provide the actual third-party attestation documents, not to assess your resource configurations.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor inspects your environment and delivers recommendations across cost optimization, performance, security, and fault tolerance, but it does not produce or host compliance reports like SOC attestations. Its checks help you follow AWS best practices and identify risky configurations, yet they lack the authoritative audit artifacts needed for an annual compliance submission. Accordingly, it cannot substitute for AWS Artifact in this context.
When this WOULD be correct
An exam scenario where a company wants to check if their AWS account is following AWS best practices for security (e.g., whether security groups are overly permissive) and needs automated recommendations to improve their security posture. In that case, AWS Trusted Advisor would be the correct service to use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ArtifactCorrect answer▾
Why this is correct
AWS Artifact is the designated service for obtaining compliance documentation directly from AWS, offering on-demand access to SOC, PCI, and ISO reports along with agreements such as HIPAA BAA. These reports can be downloaded from the AWS Management Console or programmatically via the AWS Artifact API, making it the appropriate choice for an annual compliance review. Its role is to provide the actual third-party attestation documents, not to assess your resource configurations.
✗AWS Security HubWrong answer — click to see why▾
Why this is wrong here
AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not provide access to AWS SOC reports. The auditor specifically requested the SOC 2 Type II report, which is available through AWS Artifact.
★ When this WOULD be the correct answer
A company needs to centrally view and manage security findings from multiple AWS services and automate compliance checks against standards like CIS AWS Foundations. AWS Security Hub would be the correct service to aggregate and prioritize security alerts.
Why candidates choose this
Candidates may confuse Security Hub's compliance dashboard with the ability to download compliance reports, or assume that any security-related request should go through Security Hub.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, not for downloading compliance reports like SOC reports. The auditor's request is for a specific AWS compliance document, which is provided by AWS Artifact.
★ When this WOULD be the correct answer
AWS Config would be correct if the question asked: 'Which service can be used to continuously monitor and record AWS resource configurations and evaluate them against desired configurations for compliance auditing?'
Why candidates choose this
Candidates may confuse 'compliance' in the context of AWS Config (resource configuration compliance) with the compliance reports available in AWS Artifact, leading them to select Config for audit-related requests.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides best practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide access to compliance reports like SOC reports. The company needs to retrieve the AWS SOC 2 Type II report, which is available through AWS Artifact, not Trusted Advisor.
★ When this WOULD be the correct answer
An exam scenario where a company wants to check if their AWS account is following AWS best practices for security (e.g., whether security groups are overly permissive) and needs automated recommendations to improve their security posture. In that case, AWS Trusted Advisor would be the correct service to use.
Why candidates choose this
Candidates may confuse Trusted Advisor's security checks with compliance reporting, assuming it provides audit-related documents. The name 'Trusted Advisor' sounds authoritative and relevant to audits, leading them to select it without knowing its actual scope.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is preparing for an annual compliance audit. The auditor requests a copy of the AWS SOC 2 Type II report to review AWS's controls. Which AWS service or tool can the company use to obtain this report?
medium- A.AWS Config
- ✓ B.AWS Artifact
- C.AWS Trusted Advisor
- D.AWS Security Hub
Why B: AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC reports, PCI reports, and ISO certifications. The company can use AWS Artifact to download the SOC 2 Type II report directly, fulfilling the auditor's request without needing to contact AWS support.
Variation 2. A financial services company is preparing for an annual audit. The auditors have requested a copy of the AWS SOC 2 Type II report to verify the security controls of the AWS infrastructure that the company uses. The company's compliance officer needs to directly download this report from a trusted AWS source. Which AWS service should the compliance officer use to obtain the report?
medium- A.AWS Config
- ✓ B.AWS Artifact
- C.AWS Trusted Advisor
- D.Amazon Inspector
Why B: AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC 2 Type II reports, ISO certifications, and PCI DSS reports. The compliance officer can directly download the SOC 2 report from the AWS Artifact console or via the AWS Artifact API, ensuring the report comes from a trusted AWS source.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.