CLF-C02 Security and Compliance Practice Question
A financial services company is undergoing an external audit. The auditor requests copies of AWS SOC 2, ISO 27001, and PCI DSS compliance reports to validate the company's cloud infrastructure controls. Where can the company's compliance team obtain these reports in a centralized manner?
⚠ Common exam trap
Many exam-takers confuse AWS Artifact with AWS Audit Manager, thinking that Audit Manager’s evidence collection feature also provides the raw compliance reports, when in fact Audit Manager only helps you gather your own evidence while Artifact is the sole source for AWS’s pre-existing certifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Artifact
AWS Artifact is the correct service because it provides a centralized, self-service portal for on-demand access to AWS compliance reports, including SOC 2, ISO 27001, and PCI DSS. The compliance team can download these reports directly without needing to contact AWS support, making it the single source of truth for audit evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is a service that records and evaluates the configuration of your AWS resources against predefined or custom rules, allowing you to see whether a specific resource is compliant with your internal policies. While it can help you track your own resource-level compliance over time, it does not provide or expose AWS's independent audit reports, such as SOC or ISO certifications. Those reports are third-party attestations about AWS's infrastructure and are only available through AWS Artifact.
When this WOULD be correct
A question asking: 'Which AWS service can be used to monitor and record configuration changes to AWS resources to ensure compliance with internal policies?' would make AWS Config the correct answer.
- ✓
AWS Artifact
Why this is correct
AWS Artifact is the correct service. It is a self-service portal that provides on-demand access to AWS compliance reports, such as SOC, ISO, and PCI DSS, as well as agreements like the Business Associate Addendum (BAA).
- ✗
AWS Audit Manager
Why it's wrong here
AWS Audit Manager is designed to help you continuously audit your AWS usage by automating the collection of evidence needed for your own internal or regulatory assessments. It lets you create assessment frameworks and gather resource configurations, user activities, and other data to demonstrate compliance. However, it does not contain AWS's own pre-existing compliance documentation or certifications; rather, it helps you generate evidence for your own audits, whereas AWS Artifact provides the official reports from AWS's independent auditors.
When this WOULD be correct
A company wants to automate evidence collection for internal audits and continuously monitor compliance against frameworks like PCI DSS or ISO 27001. AWS Audit Manager would be the correct service to create assessment frameworks, collect evidence, and generate audit reports.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub aggregates and prioritizes security findings from across your AWS accounts, integrating services like GuardDuty, Inspector, and Macie. It can evaluate your environment against compliance standards such as CIS AWS Foundations and PCI DSS, but the output is a security posture score and a list of findings, not a document repository. It does not give you access to AWS's own third-party audit certifications, which are distributed exclusively through AWS Artifact.
When this WOULD be correct
A company needs to continuously monitor its AWS environment against security best practices and compliance frameworks (e.g., CIS benchmarks, PCI DSS controls) and receive automated findings. AWS Security Hub would be the correct answer for centralizing security alerts and compliance checks.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ArtifactCorrect answer▾
Why this is correct
AWS Artifact is the correct service. It is a self-service portal that provides on-demand access to AWS compliance reports, such as SOC, ISO, and PCI DSS, as well as agreements like the Business Associate Addendum (BAA).
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is a service for evaluating resource configurations against rules, not for accessing compliance reports like SOC 2, ISO 27001, or PCI DSS. It does not provide a repository for downloading third-party audit reports.
★ When this WOULD be the correct answer
A question asking: 'Which AWS service can be used to monitor and record configuration changes to AWS resources to ensure compliance with internal policies?' would make AWS Config the correct answer.
Why candidates choose this
Candidates may confuse AWS Config's compliance evaluation capabilities with the ability to access compliance reports, as both involve 'compliance' in their names.
✗AWS Audit ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Audit Manager helps continuously audit AWS usage, but it does not provide pre-existing compliance reports like SOC 2, ISO 27001, or PCI DSS. Those reports are available only through AWS Artifact.
★ When this WOULD be the correct answer
A company wants to automate evidence collection for internal audits and continuously monitor compliance against frameworks like PCI DSS or ISO 27001. AWS Audit Manager would be the correct service to create assessment frameworks, collect evidence, and generate audit reports.
Why candidates choose this
The name 'Audit Manager' suggests it manages audit-related documents, leading candidates to assume it stores compliance reports. However, it focuses on automating evidence collection, not providing pre-existing third-party reports.
✗AWS Security HubWrong answer — click to see why▾
Why this is wrong here
AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not store or provide downloadable copies of third-party audit reports like SOC 2, ISO 27001, or PCI DSS. Those reports are available only through AWS Artifact.
★ When this WOULD be the correct answer
A company needs to continuously monitor its AWS environment against security best practices and compliance frameworks (e.g., CIS benchmarks, PCI DSS controls) and receive automated findings. AWS Security Hub would be the correct answer for centralizing security alerts and compliance checks.
Why candidates choose this
Candidates may confuse Security Hub's compliance monitoring capabilities with the ability to access audit reports, assuming that a security and compliance service would also provide the underlying compliance documentation.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.